chore(deps): consolidate the three Dependabot groups into one bump

[choraria]

Consolidates the three open Dependabot PRs — #865, #866, #867 — into one branch, one CI run, one merge.

Merging them serially would cost two @dependabot rebase round-trips and three full CI cycles (the
strict_required_status_checks_policy ruleset stales every other PR on each merge), and the
deploy-auth / deploy-web / deploy-wedge jobs stay red on Dependabot-authored PRs because those
runs use the Dependabot secret store and never see CLOUDFLARE_ACCOUNT_ID. On a normal branch they
get the real Actions secrets, so the deploy dry-runs go green too.

What's in it

• chore(deps): bump the github-actions group with 2 updates #865 — github-actions: github/codeql-action/init + /analyze 4.37.3 → 4.37.4 (pinned SHAs).
• chore(deps-dev): bump the dev-tooling group with 9 updates #866 — dev-tooling: @cloudflare/vitest-pool-workers 0.19.0 → 0.20.1, @cloudflare/workers-types
  → 5.20260804.1, wrangler 4.115.0 → 4.118.0, turbo 2.10.7 → 2.10.8, lint-staged 17.2.0 → 17.3.0,
  @playwright/test 1.62.0 → 1.62.1, @types/pg → 8.20.3, @vitejs/plugin-react → 6.0.5,
  @redocly/cli 2.41.1 → 2.44.1.
• chore(deps): bump the production-minor group with 10 updates #867 — production-minor: @cloudflare/workers-oauth-provider 0.8.2 → 0.8.3, lucide-react
  1.27.0 → 1.28.0, react + react-dom 19.2.7 → 19.2.8, the six remotion packages 4.0.500 → 4.0.503,
  plus @types/react 19.2.18 / @types/react-dom 19.2.4.

Notes

@cloudflare/vitest-pool-workers 0.20.0 is a breaking release — it removed wrappedBindings,
cacheWarnUsage, fetchMock, and containerEngine from the miniflare override options. None of
our five workers-pool configs (apps/auth, apps/mcp, apps/dmarc, apps/play, apps/engine) use
any of them; they only set compatibilityDate, compatibilityFlags, kvNamespaces, and bindings.
All 29 test tasks pass under 0.20.1.

Two dev deps float slightly past their Dependabot pins because the lockfile was regenerated from
main rather than merged: @cloudflare/workers-types resolves to 5.20260804.1 (vs 5.20260801.1) and
@redocly/cli to 2.44.1 (vs 2.43.2). Both are within the declared caret ranges and both are dev-only.

react/react-dom in packages/video stay at 19.2.7 — that package consumes them through the
catalog: protocol, and Dependabot bumped the direct ^19.2.8 ranges without touching the
pnpm-workspace.yaml catalog pin. That's #867's own behaviour, carried over unchanged rather than
widened here.

Conflicts on packages/video, apps/{auth,web,www}, and packages/ui package.json were resolved to
the higher version of each key. pnpm-lock.yaml was reset to main's copy and regenerated with
pnpm install rather than hand-merged.

Test plan

Full gate, turbo cache forced off (TURBO_FORCE=true) so nothing replayed a pre-bump cached log:

• pnpm lint — 997/997 guard tests pass
• pnpm format:check — clean
• pnpm typecheck — 33/33
• pnpm test — 29/29 tasks, incl. every workers-pool suite on the new major
• pnpm build — 24/24
• pnpm no-skipped-tests — clean
• pnpm overrides-guard — all 14 security pins still hold across 1290 lockfile packages (the
  regenerated lockfile moved nothing below its floor)
• pre-push hook — 30/30 incl. @webhook-co/db:test

Closes #865
Closes #866
Closes #867