Upgrade every dependency the toolchain can carry

[mkuznets]

npm audit reported one low advisory in the root project and six high ones in both Workers fixtures. All three lockfiles now report zero.

What moved

Where	Was	Now
root	esbuild 0.27.3	^0.28.2 — clears GHSA-g7r4-m6w7-qqqr
root	@cloudflare/workers-types ^4	^5.20260815.1
both fixtures	wrangler ^4.63	^4.123.0 — clears 6 high ws/undici advisories
both fixtures	@cloudflare/vitest-pool-workers ^0.12.10	^0.21.3
both fixtures	vitest ^3.2.4	^4.1.10
both fixtures	typescript ^5.5.2	^5.9.3, matching root
toolchain	javy v8.0.0, buf v1.65.0	v9.1.0, v1.72.0
CI	Node 24.12.0, npm 11.6.2, checkout v5.1.0	24.19.0, 12.0.2, v7.0.1 (SHA-pinned)

hono, prettier, and the javy npm shim were already current.

Changes the upgrades forced

vitest-pool-workers 0.21 is not a drop-in:

• It dropped the /config entry point, so both vitest.config.ts compose cloudflareTest() as a Vite plugin alongside defineConfig from vitest/config.
• ProvidedEnv augmentation became Cloudflare.Env, and the test tsconfigs point at @cloudflare/vitest-pool-workers/types.
• Per-test storage isolation is no longer implicit — both test/setup.ts now await reset() in beforeEach. This one is load-bearing: without it 28 tests fail on tables leaked from the previous test, so the isolation the suites assume is still genuinely enforced.

Also: check-generated-drift.ts uses Buffer.compare instead of .equals, which workers-types v5's global Buffer no longer exposes; and both worker-configuration.d.ts are regenerated with the new wrangler. The wrangler.jsonc compatibility dates are untouched — those are deliberate pins.

@types/node is pinned to the 24 line everywhere rather than the newest release. The fixtures were on 25, an EOL line, while CI pins Node 24 LTS. Happy to move the whole toolchain to Node 26 instead if you'd rather chase latest there.

Deliberately left behind

• TypeScript 7.0.2 — removes moduleResolution: node10, and the native port doesn't expose the compiler API (transpileModule, ModuleKind, ScriptTarget) that test/generator/evaluate.ts and scenarios.ts compile fixtures with.
• @bufbuild/protobuf 2.14.0 — 287 message constructions plus the plugin's stdin decode path would need rewriting to the schema-based API.

Neither resolves an advisory; both are worth their own change if wanted.

Verification

make verify-local fully green against a freshly built plugin: 80 unit + 27 candidate tests, generated-output drift clean under javy 9, 33 miniflare tests, 5 example tests. make fmt-check clean. Regenerating the protobuf bindings with buf 1.72.0 produced no diff.