Patch retained tooling dependencies and check caller compatibility

[mswilkison]

Patch advisory-affected dependencies that remain after #182 while retaining Hardhat 2 and Ethers 5. Use caller-scoped overrides for the legacy Axios clients, Hardhat HTTP/ZIP dependencies, Ethers WebSockets, Mocha serialization/diffs, and solc temporary files; update both YAML majors and the compatible parser dependencies. Axios 1.x callers remain on 1.x and ESLint retains YAML 3's API.

Add a separate local compatibility suite and run it in CI. It exercises actual Hardhat RPC/download paths and proxy connections, Ethers WebSocket requests/subscriptions, Mocha workers and assertion diffs, ZIP extraction, temporary files, the four legacy Axios callers, Express query/form parsing, and both YAML APIs.

Stacked on #182 (chore/dependency-toolchain-refresh, base 14843ac). Merge #182 first, then retarget this PR to main. It is independent of the governance source fix in #196.

Security coverage:

• Together with Modernize dependency toolchain and prune vulnerable packages #182, the resulting lockfile removes affected versions for 147 of the 168 open Dependabot alerts retrieved on 2026-09-11. This checks every affected range within each advisory, including alternative ws major versions, rather than only each alert's original range.
• The 21 remaining version matches are documented in docs/dependency-security.adoc: 18 Solidity-library matches, cookie serialization unused by the retained Sentry parser, UUID buffer APIs unused by Hardhat's v4(), and the unpatched elliptic truncation issue whose preconditions are absent from the retained secp256k1/32-byte signing callers. Hardcode grant stake owners in KeepStake library #26's custom quorum logic is addressed separately by Preserve historical proposal outcomes when quorum changes #196; this PR does not change Solidity dependencies.
• A fresh npm advisory check additionally covers the fast-uri, qs, diff and ws versions. Registry malware name matches for the existing GitHub-sourced lint configurations are separated by source provenance; their vendoring already has PR Vendor solhint-config-keep/eslint-config-keep/prettier-config-keep #194.
• Alert counts are projected until the stack is merged and GitHub analyzes the default branch. No alerts were dismissed.

Validation:

• Frozen install; build; typecheck and full lint/formatting; 380 contract tests and 14 tooling integration tests pass on Node 22.
• Creation/runtime bytecode and link references are identical to Modernize dependency toolchain and prune vulnerable packages #182 for all 25 deployable local artifacts.
• Local deployment, prepack, npm publication dry run using committed mainnet artifacts, and generation of 17 documentation pages pass. No publication or public-network deployment occurred.
• Actionlint and diff checks pass. Independent review found no concrete bypass/regression and additionally checked multipart Sourcify submission, Hardhat's alternate HTTP client, and AJV reference resolution using local fixtures.
• ZIP API compatibility was exercised with a fixture on macOS; a native Windows run was not performed.

CI passes on head a6029c0: all 380 contract tests and 14 tooling integration tests, formatting, deployment dry run, documentation preview, and Slither.