fix(build): refresh committed action distribution

[John-David Dalton (jdalton)]

Summary

• Refresh the committed distribution bundle to match the current source build.
• Include the dependency manifest changes needed by the release branch.

Validation

• CI generated and checked the distribution artifact on the repair branch.
• Repository CI must confirm the resulting bundle and action workflows.

---

Note

Medium Risk
The action’s bundled HTTP/fetch/WebSocket/EventSource runtime changes with the undici minor bump, so upgrade, retry, and streaming edge cases deserve extra CI attention.

Overview
Refreshes the committed GitHub Action bundle (dist/main.js) and aligns the workspace catalog/overrides with the build that produced it, notably undici 6.28.0 → 6.29.0.

The rebuilt bundle picks up undici behavior changes across the HTTP stack: upgrade/CONNECT paths now emit header/trailer diagnostics, handle post-upgrade responses/errors (including HTTP/2 CONNECT), and adjust abort handling when a request is already complete; idle socket validation uses setImmediate instead of setTimeout. Retry logic tracks whether response headers were forwarded, checkpoints body length before retries, and turns content-range mismatches into retry failures instead of hard asserts. WebSocket handshake protocol matching tolerates a missing client protocol list and tears down the inflater on oversize payloads. EventSource parsing is reworked to scan chunk buffers with byte-level field checks rather than repeatedly concatenating a single buffer.

pnpm-workspace.yaml also bumps several fleet catalog pins (e.g. vitest 5.0.2, @types/node, yaml) and drops the vitest@5.0.1 patched dependency entry that no longer applies at the new version.

^{Reviewed by Cursor Bugbot for commit d0db4e6. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d0db4e6. Configure here.}

[cursor]

Vitest patch dropped on bump

Medium Severity

Bumping vitest to 5.0.2 removed the patchedDependencies entry without a replacement vitest@5.0.2 patch. The leftover comments still describe the fleet coverage matcher and --cpu-prof teardown fixes, but those patches no longer apply, so coverage membership and profiled-fork shutdown fall back to unpatched 5.0.2 behavior.

 

^{Reviewed by Cursor Bugbot for commit d0db4e6. Configure here.}