[codex] resolve DevRev dependency advisories

[shriram-devrev]

Summary

• upgrade vulnerable tar, js-yaml, and brace-expansion dependency chains
• upgrade Electron and Puppeteer to remove the unpatched public extract-zip package
• constrain the nested semantic-release npm dependency so its bundled tar is fixed
• align the supported Node range with the upgraded npm runtime

Root cause

The reported Snyk advisories were introduced through direct and transitive npm dependencies. extract-zip has no patched public release, so its parent packages are upgraded to versions that no longer depend on it.

Validation

• npx nx run-many --target=build --all --parallel
• node@24.15.0 node_modules/nx/bin/nx.js run-many --target=test --all --exclude=benchmarking-app --parallel=3
• targeted npm audit check confirms no findings for tar, js-yaml, extract-zip, or brace-expansion

work-item: ISS-331766

ISS-331766
ISS-331767
ISS-335950
ISS-336523