deps: remediate remaining upstream development-tool audit findings #61

A fresh locked root npm audit during PR #56 queue validation reports three remaining high-severity package entries after compatible updates to ip-address, brace-expansion, and protobufjs. The generated docs starter separately audits cleanly.

Affected root development dependencies:

• @mariozechner/pi-coding-agent 0.73.0: GHSA-jfgx-wxx8-mp94, GHSA-r95r-rj6r-c39x, GHSA-7v5m-pr3q-6453 affect versions through 0.73.1. Registry latest was 0.73.1 when checked. npm's suggested downgrade to 0.49.3 is not a compatible maintenance update.
• extract-zip 2.0.1 (via Pi): GHSA-jmr9-qjv8-65gv and GHSA-7pqw-9j4j-h8q3. No compatible patched replacement was established in the current Pi graph.
• basic-ftp 5.3.0 (via get-uri ^5.0.2): GHSA-rpmf-866q-6p89 and GHSA-c475-qrg2-pj4r. The patched current major (6.2.2) is outside the parent range.

Acceptance criteria:

• Select supported upstream releases or a compatible parent migration; avoid a forced Pi downgrade or untested major override.
• Validate the full repository check, package dry run, and isolated extension startup.
• Re-run locked npm audit and record remaining advisory evidence accurately.
• Update dependency documentation and obtain independent review before merging.

This issue records existing upstream risks; PR #56 does not claim the root audit is zero. No credential, access, infrastructure, or deployment changes are requested.