fix(deps): override vulnerable ansi-regex

[AlexStocks]

Summary

• add a package-root pnpm override that resolves every current ansi-regex
  request in the OpenClaw memory plugin to the patched 5.0.1 release
• regenerate the lockfile with pnpm 10.34.5, remove ansi-regex@5.0.0, and
  preserve the Apache-2.0 header
• record reusable dependency-remediation and native-test synchronization rules
  in AGENTS.md
• replace the SeekDB cancellation fixture's timing-dependent native sleep with
  an explicit entry/release barrier after exact-head linux-arm64 CI exposed the
  sleep race; production SeekDB behavior is unchanged

Closes #11.

Security rationale

The vulnerable runtime path was:

openclaw -> qrcode -> yargs -> cliui@6.0.0 -> strip-ansi@6.0.0 -> ansi-regex@5.0.0

GitHub Advisory GHSA-93q8-gq69-wqmw / CVE-2021-3807 marks
ansi-regex >=5.0.0,<5.0.1 as vulnerable and 5.0.1 as the first patched
5.x release. The root manifest override is compatible with the current graph
and avoids upgrading OpenClaw or unrelated transitive dependencies.

CI follow-up

The first refreshed exact-head run failed only in
Full build tags (linux-arm64). The failure came from
TestOpenClosesNativeInstanceWhenCancellationRepeatsDuringHandshake: its C
fixture wrote an entry marker and then called nanosleep once, assuming the
call would last 100 ms. POSIX permits nanosleep to return early when a signal
interrupts it, so the native call could finish before the Go test issued
cancellation.

The fixture now blocks on an explicit release marker. The Go side observes
entry, cancels the context, and then releases the native call. This preserves
the same public Open error and native-close assertions without relying on
scheduler timing or a longer timeout.

Behavior and compatibility

• no application API, protocol, persistence, generated contract, or host
  version change
• no production SeekDB implementation change
• the OpenClaw plugin keeps its existing dependency ranges and resolves the
  vulnerable transitive edge to ansi-regex@5.0.1

Validation

Security and package checks:

• current main: pnpm audit --json reports one HIGH advisory on
  ansi-regex@5.0.0
• final candidate: pnpm 10.34.5 frozen install succeeds, pnpm why ansi-regex
  reports only 5.0.1, and pnpm audit --json reports zero vulnerabilities
• Node 24.15.0: typecheck, 16/16 Vitest tests, and build pass with no generated
  dist difference
• license-eye: 959 files checked, 0 invalid

SeekDB cancellation checks:

• WSL Go 1.27 targeted test: 200 repeated runs pass
• race-enabled targeted test: 50 repeated runs pass
• full internal/sqlstore/seekdb package passes
• a disposable mutant with both post-native cancellation checks removed fails
  with open error = <nil>, want context cancellation

GitHub exact-head evidence for b34d189bb8de8fa9cd7465e3ed66c8c39403c0f9:

• 4/4 workflow runs completed successfully: Main, E2E harness, CodeQL, and
  License Check
• 27/27 check runs completed successfully, including linux-arm64 Full build
  tags, race/fuzz/module integrity, both acceptance backends, coverage, and
  all Linux/macOS standard/full matrices
• PR merge state is CLEAN and MERGEABLE; the GitHub merge-ref tree matches
  the reviewed Head tree

AI usage

Implemented and reviewed with Codex assistance. The advisory range, dependency
graph, Base/Head audit result, POSIX interruption behavior, deterministic test
mutation, final diff, comments, merge ref, and exact-head CI were verified
against current sources and reproducible commands.