chore: refresh development dependencies

[steipete]

Summary

• update Oxfmt to 0.57.0 and Oxlint to 1.72.0
• constrain transitive Vite to ^8.0.16, clearing GHSA-fx2h-pf6j-xcff and GHSA-v6wh-96g9-6wx3
• explicitly exempt the patched Vite release from pnpm's release-age gate so clean installs cannot retain vulnerable 8.0.12

Proof

• pnpm install --frozen-lockfile
• pnpm typecheck
• pnpm lint
• pnpm format:check
• pnpm test — 877 passed, 1 skipped
• pnpm build
• pnpm website:smoke
• pnpm pack:smoke
• pnpm audit --json — 0 vulnerabilities
• pnpm outdated --format json — empty
• structured autoreview — clean, no actionable findings

Risk: low. Development tooling and lock policy only; no runtime or model-bearing surface. No changelog entry because this has no user-visible behavior.

[steipete]

Exact-head proof for bd2b81f9f86ad70532b30c3875ecc844b12229c0:

• CI: https://github.com/openclaw/clawpatch/actions/runs/28499674085
• CodeQL: https://github.com/openclaw/clawpatch/actions/runs/28499674028
• dependency review: https://github.com/openclaw/clawpatch/actions/runs/28499674061
• secret scan: https://github.com/openclaw/clawpatch/actions/runs/28499674048
• local: frozen install; typecheck; lint; format; build; website/package smoke; 877 tests passed, 1 skipped
• dependency state: pnpm audit --json reports zero vulnerabilities; pnpm outdated --format json is empty
• structured autoreview: clean, no accepted/actionable findings
• Public Model Identifier Gate: not applicable; no model-bearing surface changed