Refresh CLI dependencies and preserve Node 20 compatibility

[skvark]

The CLI's locked dependencies contained known security advisories, and Commander 15 required Node 22 despite the package advertising Node 20 support. Refresh the CLI dependencies and use maintained Commander 14.0.3 so the declared runtime support is installable with strict engine checks.

• Reviewed dependency security, release notes, API changes, and Node requirements with GitHits; regenerated bun.lock through Bun without manual lockfile edits.
• Keep Undici on 7.30.0 for Node 20, Braintrust on 3.37.0 for the three-day minimum release age, and lint-staged on 17.5.1 to avoid 17.6's broader staging behavior. Pin Bun types to the reviewed version.
• Add a regression check comparing the CLI and Commander engine ranges, and correct the stale live grep smoke assertion.
• Record a pending CLI patch release; the MCP package manifest and release impact remain unchanged.

Validation with Bun 1.4.2:

• 5,663 tests pass; typecheck, build, formatting, lint, and public-package consumer validation pass. Formatting and package validation used a clean LF checkout to avoid existing Windows line-ending/tooling issues; lint retains existing warnings.
• Live CLI smoke: all 161 steps pass, including CLI/MCP JSON parity.
• Built CLI and MCP smoke pass on Node 20.18.1 and 22.13.0. A fresh tarball installation with npm install --engine-strict --omit=dev succeeds on Node 20.18.1 (lifecycle scripts disabled).
• Bun audit: no known vulnerabilities across 336 packages.
• Live MCP stable checks pass. The experimental research follow-up hit backend rate limiting on both attempts; the diagnostic retry confirmed Research is rate limited with a retry delay. This remaining live-service limitation is not suppressed by the tests.