Fix Dependabot Alerts

Use gh api to get live alert data, then make the smallest safe dependency changes that resolve the current open alerts.

Workflow

1. Establish the repository context

1. Read AGENTS.md and the instructions for every affected project.
2. Inspect git status --short and the relevant diffs. Preserve unrelated user changes.
3. If GitHub access fails, run gh auth status. Treat 403 and 404 responses as possible permission or feature-availability problems, not proof that the repository has no alerts. Do not change authentication or repository settings without the user's approval.

2. Fetch the current alerts

Always query GitHub at the start of the task. Treat "latest alerts" as the current open alerts unless the user gives a narrower scope.