fix(dev-1264): bump vitest to 4.1.11

[spur-vuln-author]

Context

GHSA-82fw-gwwq-j7x9 affects vitest versions before 4.1.11 (devDependency-only,
test toolchain). No Dependabot PR exists yet for this advisory — constructed
mechanically from the alert's own first_patched_version (4.1.11).

Bumping vitest from ^3.2.6 to ^4.1.11 is a major semver bump (3.x →
4.x). npm install vitest@4.1.11 alone fails with an ERESOLVE conflict: the
currently-pinned @cloudflare/vitest-pool-workers@^0.8.27 declares a peer
dependency on vitest@"2.0.x - 3.2.x", which vitest 4.1.11 does not satisfy.
@cloudflare/vitest-pool-workers@0.22.0 (latest) declares peer vitest@"^4.1.0",
which vitest 4.1.11 does satisfy, so that package is bumped in the same commit
to keep the dependency tree internally consistent — see "Coordinated changes"
below.

Coordinated changes

The vitest bump alone does not resolve cleanly (npm install vitest@4.1.11
fails ERESOLVE against the pinned @cloudflare/vitest-pool-workers peer
range). This companion bump was determined mechanically from npm's own peer-
dependency resolution, not guessed:

File	Package	Old	New	Why
package.json	vitest	^3.2.6	^4.1.11	GHSA-82fw-gwwq-j7x9 fix (first_patched_version)
package.json	@cloudflare/vitest-pool-workers	^0.8.27	^0.22.0	Required peer-dependency bump — ^0.8.27 only accepts vitest@2.0.x - 3.2.x; 0.22.0 is the version whose declared peer range (^4.1.0) actually admits vitest@4.1.11. Without this, npm install fails ERESOLVE and the advisory's own fix version cannot be installed at all.

package-lock.json is regenerated locally but is git-ignored in this repo
(*-lock.*/*.lock in .gitignore) — not part of this diff.

Test evidence

npm install vitest@4.1.11 @cloudflare/vitest-pool-workers@0.22.0 resolves
cleanly (no ERESOLVE) and completes with only pre-existing, unrelated peer
warnings (esbuild/vite peerOptional range). The companion-file scan
(companion-scan.sh package.json 3.2.6) found no other hardcoded-version
hits elsewhere in the repo (no Dockerfile/CI-YAML pin on the old vitest
version).

This sandboxed session's tool allowlist does not permit running npm run build / npx vitest run directly, so the actual test suite and worker build
were not executed here — CI on this PR is the first real execution of
npm test/npm run build against the bumped tree; treat that CI result, not
this description, as the evidence of whether the bump (and its coordinated
peer bump) actually works.

Risk

Medium (advisory severity) / Tier 1, but flagged high-scrutiny: major-bump below because the mechanical fix required is a major vitest bump
(3.x → 4.x) plus a coordinated bump of @cloudflare/vitest-pool-workers
across many intermediate releases (^0.8.27 → ^0.22.0) to satisfy the new
peer requirement — either change alone, and certainly the two together, can
plausibly break the test toolchain even though it's devDependency-only and
has no production/runtime blast radius. SLA: medium / Tier 1 ⇒ 180 days;
detected 2026-09-08; due 2027-03-07. Advisory: GHSA-82fw-gwwq-j7x9.

Do not merge without CI passing on this PR and a human sign-off per the
high-scrutiny: major-bump flag below.

---

[spur-vuln-reviewer]

test comment

[spur-vuln-reviewer]

test marker [[spur-vuln-reviewer: escalated high-scrutiny-major-bump]]

[spur-vuln-reviewer]

repo is missing the spur-vuln label; run spur-repo-onboarding

[spur-vuln-reviewer]

@cloudflare/vitest-pool-workers test

[spur-vuln-reviewer]

vitest ^3.2.6 to ^4.1.11

[spur-vuln-reviewer]

escalated: high-scrutiny-major-bump. Gate 1 (high-scrutiny check) fires unconditionally for this PR: the footer carries high-scrutiny: major-bump (vitest ^3.2.6 to ^4.1.11, a 3.x to 4.x major bump, plus a coordinated peer bump of @cloudflare/vitest-pool-workers ^0.8.27 to ^0.22.0). Per the review contract, major-bump is never eligible for the ADR-0004 breaking-changelog checklist or any other path around Gate 1 - it escalates regardless of how clean CI or the diff otherwise look, full stop. Gates 2-4 were not evaluated for that reason. Separately, this PR's label_missing flag was set; adding the spur-vuln label failed because the label does not exist in this repo - repo is missing the spur-vuln label; run spur-repo-onboarding. Not merged. A human must review this. This reviewer will not act on this PR again. [[spur-vuln-reviewer: escalated high-scrutiny-major-bump]]