chore(deps-dev): bundle the vitest, vite, undici and source-map-js bumps (#35)

## Why

Four Dependabot PRs each changed only `package-lock.json`, and they conflict with each other. This PR applies all of them in one lockfile so they land together.

The same packages carry all 13 open Dependabot alerts on `main` (5 high). Every alert's patched version is at or below the version in this lockfile.

## What changed

- vitest and @vitest/mocker 4.1.11 → 4.1.12 (from #22).
- vite 8.3.0 → 8.3.5. #22 already moves vite past the 8.3.4 in #20.
- undici 6.28.1 → 6.29.1 (from #34) and source-map-js 1.2.1 → 1.2.2 (from #19).

## Scope

- The lockfile is #22's lockfile plus `npm update --package-lock-only undici source-map-js`. Every package version that changed matches a version one of the four PRs proposed. No package is added or removed.
- `package.json` is unchanged. All bumps are dev dependencies.
- This PR replaces Dependabot PRs #19, #20, #22 and #34.

## Tradeoffs

- `npm update vite` alone would also move rolldown to 1.2.16 and bump postcss and @types/estree. No Dependabot PR proposed those versions, so I left them out.

## Blast Radius

Dev and test tooling only. The published package does not ship these dependencies.

## Verification

- Local `mise run ci` steps on Node 26.12.1: npm ci, build:libghostty, build:native, build, 40/40 tests, smoke all pass.
- A script compared every lockfile entry with the four PR lockfiles and found no extra or missing changes.

---
_Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_

Author: ThomasK33