fix(deps): override transitive adm-zip to 0.6.0 (CVE-2026-39244)

Root-level Bun overrides entry moving the copy resolved under @huggingface/transformers/onnxruntime-node off the vulnerable 0.5.x line. Verified: frozen install clean, bun pm why shows 0.6.0 in the transitive position, full plugin suite (4044) green including the local-embedding load path. Thanks @anupamme.