chore: remove temporary SDK Zod audit exception after upstream fixes #485

Context

Track removal of the temporary TypeScript CI exception for Zod advisory GHSA-mrhx-c7xc-m3w5 (CVE-2023-54404), introduced by #484. This is a repository CI exception, not a claim of formal nSpect approval or that the vulnerable code is unreachable.

The exception is limited to these locked Zod copies:

• node_modules/@factory/droid-sdk/node_modules/zod: 3.25.76
• node_modules/@qwen-code/sdk/node_modules/zod: 3.25.76
• node_modules/gitlab-ai-provider/node_modules/zod: 3.25.76
• node_modules/zod: 4.1.8 (OpenCode)

Parent-package audit findings may be excepted only when their high-severity dependency paths lead to this advisory. Their package paths and locked versions are also checked. Other high findings and all critical findings remain blocking.

Follow-up

• Fabric maintainers: review this exception by 2026-11-23.
• Assess whether attacker-controlled oversized collections reach the affected SDK validators and which pre-validation input limits apply.
• Track compatible upstream SDK releases; Droid, Qwen, and GitLab provider latest releases still require Zod 3 as of 2026-10-24. OpenCode retains an exact Zod 4.1.8 dependency.
• Do not force Zod 4 over Zod 3 constraints: API changes and bundled code require upstream compatibility work.

Removal criteria

Upgrade or replace affected SDK dependencies so fresh npm ci installs patched Zod versions (currently >=4.6.6), verify the full dependency tree and adapter tests, then remove this exception and its policy-specific tests. The ordinary audit gate must continue to pass without the exception. Remove individual allowed paths as upstream fixes become available.