fix(deps): repair hono-agents version + clear new production advisories

Two problems surfaced after main was merged into this branch:

1. ETARGET install failure — main (a60d0e1 "upgrade agents SDK to 0.19.0")
   set `hono-agents` to `^0.19.0`, a version that does not exist (hono-agents
   tops out at 3.0.11; 0.19.0 belongs to the separate Cloudflare `agents`
   package). package.json and the lockfile (still ^3.0.7) disagreed, so
   `npm ci` died with ETARGET and every job (build, dependency-audit, Workers
   deploy) failed at install. Restore `hono-agents` to `^3.0.7`, matching the
   lockfile's resolved 3.0.7.

2. New production advisories — since the original June remediation, fresh
   advisories landed (hono <=4.12.33, js-yaml <=4.3.0) and main pulled in new
   prod deps carrying their own HIGHs (fast-uri, ip-address, nanoid). Ran a
   semver-compatible `npm audit fix` (no --force): production tree is now
   clean.

Verified on Node 20 CI parity:
- `npm ci` succeeds (ETARGET gone)
- `npm run typecheck` passes
- `npm audit --audit-level=high --omit=dev` => found 0 vulnerabilities

wrangler stays 4.73.0 (node >=20) — no Node-22 bump reintroduced. Remaining
dev-only advisories (esbuild/sharp/ws) never ship and are excluded by the
production-scoped gate. Only direct-dep change is the hono-agents correction.

Author: claude