Bump undici to 7.29.0 in CI scripts lockfile (resolves 5 Dependabot alerts)

[igerber]

Summary

• Bump undici 7.28.0 -> 7.29.0 in .github/scripts/package-lock.json (lockfile-only; undici is a transitive dev dependency of jsdom, whose ^7.25.0 spec already admits 7.29.0)
• Resolves all 5 open Dependabot alerts, all against undici < 7.29.0:
  • CVE-2026-13697 (high): cross-user information disclosure and parse-time crash via degenerate private cache directives
  • CVE-2026-15157 (medium): CRLF injection via blob-like body type property
  • CVE-2026-16729 (medium): cookie attribute injection via unsanitized domain and unparsed setCookie fields
  • CVE-2026-14643 (medium): cross-user information disclosure via whitespace around equals in Cache-Control directives
  • CVE-2026-16728 (medium): downstream response desynchronization via retry interceptor

Methodology references (required if estimator / math changes)

• Method name(s): N/A - no methodology changes
• Paper / source link(s): N/A
• Any intentional deviations from the source (and why): None

Validation

• Tests added/updated: No test changes (dependency lockfile bump for CI helper scripts only; npm audit reports 0 vulnerabilities after the bump)
• Backtest / simulation / notebook evidence (if applicable): N/A

Security / privacy

• Confirm no secrets/PII in this PR: Yes

[github-actions]

Overall assessment: ✅ Looks good

Executive summary

• No estimator, inference, assumptions, or methodology code is affected.
• Lockfile remains consistent: jsdom permits undici ^7.25.0, resolving to 7.29.0.
• Node 24 in CI satisfies undici’s Node ≥20.18.1 requirement.
• npm ls --package-lock-only completed successfully.

Methodology

No findings. Severity: N/A. Impact: None; this is dependency metadata only. Concrete fix: None.

Code Quality

No findings. Severity: N/A. Impact: The version, registry URL, and integrity hash were updated together at .github/scripts/package-lock.json:L481-L489. Concrete fix: None.

Performance

No findings. Severity: N/A. Impact: No runtime library path changed. Concrete fix: None.

Maintainability

No findings. Severity: N/A. Impact: The resolved version satisfies jsdom’s declared range at .github/scripts/package-lock.json:L314-L336. Concrete fix: None.

Tech Debt

No findings. Severity: N/A. Impact: No new limitation or deferred work. Concrete fix: None.

Security

No findings. Severity: N/A. Impact: The change upgrades the affected dependency without introducing secrets or unexpected sources. Concrete fix: None.

Documentation/Tests

No findings. Severity: N/A. Impact: The existing workflow installs the lockfile and runs the consuming smoke test under Node 24. Concrete fix: None.