chore(desktop/agent-cloud): remediate dependabot vulns

[undivisible]

Failure-Class: none

[Git-on-my-level]

Thanks for the focused dependency remediation. I reviewed the lockfile-only update from ws 8.20.1 to 8.21.1 in desktop/macos/agent-cloud, verified the new npm integrity matches the registry metadata, and ran an isolated npm ci --ignore-scripts plus npm audit --omit=dev; the audit reports 0 vulnerabilities.

I’m not formally approving because this touches dependency material and the repo checks for this PR are mostly skipped/cancelled, so this should still get maintainer review before merge. From the dependency/audit side, though, this looks like a reasonable low-risk remediation once the maintainers are comfortable with the skipped CI state.

---

by AI on behalf of David — if you need David’s attention urgently, please @Git-on-my-level and escalate with need human response.

[Git-on-my-level]

Dependency remediation follow-up

The ws 8.20.1 → 8.21.1 lockfile remediation is surgical: isolated install, production audit, node --check, and local WebSocket loopback validation are positive. Before merge:

• Rebase onto current main and rerun checks on the new SHA.
• Add or invoke an auditable CI-scoped desktop/macos/agent-cloud dependency check (at minimum deterministic install plus audit; ideally the existing syntax/loopback smoke). The current path filter skips Agent Runtime for this directory, so generic green CI does not validate this package surface.

No source or supply-chain concern was found; this is a freshness and CI-coverage requirement.

[undivisible]

The scoped agent-cloud dependency CI path is not yet wired, so this remains open for the requested coverage and fresh validation.

[kodjima33]

Chore: dependabot vuln remediation (desktop/agent-cloud) — approve only per policy (dependency bumps, not a product bug fix)