release: bump zod and body-parser for audit:high (blocks 2.92.0 publish) #7638

Problem

Release dry-run for 2.92.0 on main tip 3d9ba72aa5b04b4bbea5a2871a181942afa720e7 failed at publish job Dependency audit (high severity) (bun run audit:high). Cross-platform CI on that SHA had already passed; advisories appeared after.

Advisories

• body-parser@2.3.0 via @modelcontextprotocol/sdk → express — DoS GHSA-27r3-jxmh-p828; fixed in 2.4.0+
• zod@4.4.3 (direct dep, also used by MCP SDK) — memory exhaustion GHSA-mrhx-c7xc-m3w5; fixed in 4.6.6+

Evidence: Release run 40031662901

Goal

• Raise zod to ≥4.6.6 (and lockfile) so audit is clean.
• Ensure body-parser resolves to ≥2.4.0 (override and/or lockfile update through the MCP SDK / express chain). Prefer the smallest safe change; existing package.json overrides already pin several packages.
• bun run audit:high must pass locally/CI.
• Do not bump the package version (leave 2.92.0); this is a security/lockfile fix so Release can republish the same version on a new main tip.
• PR to dev (or direct path the release train uses); after merge to main and green Cross-platform CI on the new SHA, Release dry-run then publish with expected-sha updated.

Non-goals

• SignPath approval
• Changing provider/model settings