fix(deps): resolve dependabot alerts with compliant targeted resolutions

[ernysans]

Summary

• Target resolutions for all open Dependabot alerts:
  • #83 (sharp <0.35.4): sharp pinned to 0.35.4 (published 2026-08-26, ~26 days prior).
  • #82 / #81 (qs <6.16.0): qs resolved to 6.16.0 under express and body-parser (published 2026-08-29, ~22 days prior).
  • #67 (@opentelemetry/core <2.8.0): @opentelemetry/core resolved to 2.11.0 under @google-cloud/pubsub (published 2026-08-31, ~20 days prior).
  • #64 (uuid <11.1.1): uuid resolved to 11.1.1 scoped under both gaxios and teeny-request (published 2026-04-29, ~145 days prior).
• An initial broad npm update was rolled back to compliant targeted resolutions to eliminate age policy violations (<7 days old) and unnecessary churn.
• All 30 changed package versions in the lockfile are >=7 days old relative to 2026-09-28.
• Added /:memory:.ses under ## Others in .gitignore.

Verification & Status

• npm ls has zero peer conflicts.
• npm audit reports 0 vulnerabilities.
• npm run build passed with zero drift in lib/.
• npm test passed (18 files, 966 tests).
• npm run typecheck, npm run typecheck:consumer, and npm run typecheck:consumer:control passed.
• ./.github/scripts/check-private-markers.sh passed.
• GitHub Actions CI (Node 22.x & 24.x) verified passing on commit 8cfa326240ea6c2348bef84f3b272102b696bc55.