Release 2.9.4: dotenv 18.0.9, relock zod past GHSA-mrhx-c7xc-m3w5 (#112)

## Summary

Maintenance sweep release, 2.9.4. Dev-tree changes only; nothing in the
published package changes.

- `dotenv` 18.0.8 to 18.0.9 (dev).
- `zod` 4.6.5 to 4.6.7 in the lock (a dev-only transitive through
`knip`), clearing GHSA-mrhx-c7xc-m3w5.
- `.claude/CLAUDE.md` said ESLint 9; the repo is on 10.

Checked and current: every GitHub Action and the osv-scanner binary
(v2.7.0); dependabot covers bun and actions and its last runs succeeded.

Worked with: Varun, who asked for the sweep.

Not taken: `knip` 6.43.0 (published under 24 hours ago, inside the
release-age soak; it lands next pass) and `typescript` 7 (held org-wide;
the lift condition still fails, as typescript-eslint 8.72.0 peers
`<6.1.0`).

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None.

## Test plan

`lint`, `typecheck`, `knip`, `test` (154 passed, 2 skipped) and `build`
all exit 0 locally. `osv-scanner scan source --lockfile=bun.lock`
reports no issues.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [ ] Docs and README examples updated if the public surface changed
  (the public surface did not change)
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

.claude/CLAUDE.md

@@ -36,7 +36,7 @@ Single-package TypeScript library published to npm.
 ## Tooling
 
 - **Bun**: package manager. Use `bun install`, `bun run <script>`.
-- **ESLint 9**: linting. `bun run lint`.
+- **ESLint 10**: linting. `bun run lint`.
 - **tsup**: builds CJS + ESM. `bun run build`.
 - **Vitest**: tests. `bun run test`.
 - **knip**: dead-code check. `bun run knip`.

bun.lock

@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/sdk",
-  "version": "2.9.3",
+  "version": "2.9.4",
   "description": "TypeScript client for the AgentScore APIs",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -54,7 +54,7 @@
     "@eslint/js": "^10.0.1",
     "@types/node": "^26.6.5",
     "@vitest/coverage-v8": "^5.0.5",
-    "dotenv": "^18.0.8",
+    "dotenv": "^18.0.9",
     "eslint": "^10.13.0",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-unused-imports": "^4.4.1",