[cdbartholomew]

Routine dependency maintenance for hindsight-integrations/openclaw/package-lock.json.

Closes Dependabot alerts #2265 #2266

• vitest and @vitest/* 4.1.11 → 4.1.12 (dev dependency; GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp)
• moved with vitest 4.1.12, as it requires: vite 8.3.4 → 8.3.5, rolldown 1.2.14 → 1.2.15 and its @rolldown/binding-* platform packages, @oxc-project/types 0.154.0 → 0.155.0, chai 6.2.2 → 6.3.0, nanoid 3.3.18 → 3.3.20, postcss 8.5.28 → 8.5.31, std-env 4.2.0 → 4.3.0, tinyrainbow 3.1.1 → 3.2.0

vitest and @vitest/ui devDependency floor raised to ^4.1.12 in package.json. Without it, npm update vitest is a no-op because 4.1.11 already satisfies the old range.

The lockfile was regenerated with npm@11 install --package-lock-only and then installed with npm 10.9.2 npm ci, which is what CI uses; it installs cleanly.

Verification (npm 10.9.2)

• npm ci: OK
• npx tsc --noEmit: OK
• npm run build: OK (after building the hindsight-clients/typescript and hindsight-all-npm workspace prerequisites, as build-openclaw-integration does)
• npm test: 24 files, 422 tests passed
• ./scripts/check-integration-lockfiles.sh: OK