Resolve dependency security alerts before release

[berghtho]

Dependency vulnerability alerts are enabled for the downstream fork and currently report critical, high, moderate, and low findings inherited by main.

Before the first release:

• review every critical and high alert
• identify alerts already resolved by selectable source updates
• update or replace affected dependencies without weakening Riker behavior
• document accepted residual risk for anything intentionally deferred
• verify the release dependency graph has no unreviewed critical or high alerts

Alert details: https://github.com/berghtho/t3code/security/dependabot