Fix npm security vulnerabilities

[ditto-integrations]

Summary

• tmp → 0.2.6 (CVE-2026-44705)

Resolves: SPO-1000

Workflow run

Note: Target versions are sourced from Tines and may not always
reflect the latest or most appropriate release (e.g. a version may
be deprecated upstream). Please verify that the resolved versions
in lockfiles are suitable.

Test plan

• CI passes
• No new high/critical vulnerabilities in affected lockfiles
• Affected SDK/component builds successfully

Generated by Tines + Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Kristopher Johnson (kristopherjohnson)]

Closed as superseded by #98. After #100 merged, rebasing this PR left only the tmp 0.2.6 -> 0.2.7 update. #98 then merged that same tmp update, along with the related esbuild and Vitest security updates. This branch was reset to the #98 merge commit and had no remaining dependency diff.