fix(deps): harden dependency and release boundaries (#2484)

- [x] I understand that this repository is auto-generated and my pull
request may not be merged

## Changes being requested

- Scope ecosystem-test credentials to live test and deployment commands,
with regression coverage using real local npm lifecycle scripts.
- Separate release builds from OIDC publishing, bind both jobs to the
verified release commit, transfer the package by immutable artifact ID
with digest verification, and publish the prebuilt artifact without
dynamically installing another npm version.
- Pin the MIT-licensed Steady mock server in the pnpm lockfile and use
its repository-local binary instead of downloading it on demand.
- Remove five unused development/example dependencies and their
transitive Next.js/Sharp branches, reducing the workspace lockfile from
799 to 757 package records while accounting for the six newly locked
Steady packages.
- Raise the `ws` and `minimatch` minimum versions while preserving
existing optional Undici compatibility.
- Restore the vendored partial-JSON parser's upstream MIT license,
document immutable upstream provenance for both vendored components,
remove obsolete vendored development metadata, and verify third-party
attribution survives npm packaging.

## Additional context & links

Verified with repository-pinned Node.js 24.20.0:

- `pnpm install --frozen-lockfile`
- `pnpm build`
- `pnpm test`
- `pnpm lint`
- `pnpm exec tsc --noEmit --pretty false`
- `node --experimental-strip-types scripts/test-packed-package.ts`
- `pnpm audit --json`
- Workflow permission/artifact assertions and simulated
release-publishing cases
- Trusted custom-code budget check: 2,972 / 3,000 lines

The published SDK continues to have zero mandatory runtime dependencies.