chore: update dependencies across root, MCP, and capture CLI

[sebavan]

What changed

• Update root, MCP server, and capture CLI npm dependencies to the latest stable compatible releases, and refresh all three lockfiles, including transitive dependencies.
• Align Playwright on 1.64.0 and Vitest/coverage on 5.0.4; update Babylon.js, TypeScript ESLint, ESLint, Sass, Sharp, Chrome/Node types, MCP SDK, and Zod.
• Retain TypeScript 6.0.3 with the user's approval: the latest TypeScript ESLint tooling requires TypeScript >=4.8.4 <6.1.0, so TypeScript 7.0.2 is not supported yet. Document this constraint in the build specification.
• Keep the existing CI/release security-audit gates unchanged. All three dependency trees report zero vulnerabilities, including low severity.
• GitHub Actions references already track the latest stable major releases; no workflow changes or release-version bump are needed.

Validation

Location	Exact command	Result
Root	npm ci --no-fund	Passed
Root	npm audit --audit-level=low	Passed; zero vulnerabilities
Root	npm run check:versions	Passed
Root	npm run lint	Passed
Root	npm test	Passed; 25 files, 354 tests
Root	npm run build	Passed; three non-fatal Webpack bundle-size/runtime warnings
Root	npm run test:e2e -- no-webgpu.spec.ts triangle-capture.spec.ts babylon-capture.spec.ts	Passed; 7 tests, including live Babylon.js Playground capture and continued rendering after capture
mcp	npm ci --no-fund	Passed
mcp	npm audit --audit-level=low	Passed; zero vulnerabilities
mcp	npm test	Passed; 2 files, 90 tests
mcp	npm run build	Passed
Root	npm --prefix skills\spector-gpu-capture ci --no-fund	Passed
Root	npm --prefix skills\spector-gpu-capture audit --audit-level=low	Passed; zero vulnerabilities
Root	node --check skills\spector-gpu-capture\capture-cli.js	Passed
Root	node --check skills\spector-gpu-capture\summary.js	Passed
Root	git diff --check	Passed
GitHub	gh pr checks 47 --watch --interval 15	Passed; all four CI checks green

GitHub Actions CI run passed on Ubuntu, Windows, and macOS, including dependency audits, version checks, lint, root/MCP tests and production builds; the Linux extension smoke-test job also passed. No CI fixes were needed.

npm outdated --json confirms that only the intentionally retained TypeScript major remains outdated in root and MCP; the capture CLI has no outdated dependencies. Cross-platform optional dependencies were checked against upstream changes in the regenerated lockfiles.

Impact

• Capture format or public API
• Browser permissions or privacy
• Performance-sensitive interception/readback path
• Result-viewer UI
• MCP tools
• Documentation only

Dependency-only maintenance: no application logic, MCP schemas, browser permissions, or UI changes.

Checklist

• Tests cover the changed behavior
• Relevant specs and public documentation are updated
• CHANGELOG.md is updated for a notable user-facing change
• UI changes include a screenshot or recording
• No generated build output, reports, secrets, or proprietary capture data are included

No notable user-facing or UI change is introduced by this maintenance update.