chore(deps): update eve to 0.72.1

[mrosberghaus]

Summary

 apps/web/package.json
-  "eve": "0.71.2"
+  "eve": "0.72.1"

 pnpm-lock.yaml
-  eve@0.71.2
+  eve@0.72.1
   # evlog's optional eve peer retargets to the same pin

Dedicated 0.x minor bump for eve in apps/web, kept out of weekday non-major #5834. Rebased onto current main (includes #5836 @evlog/cli 0.9.0 and #5835 CMO Next 16.4). next, @next/third-parties, @evlog/cli, overrides, and packageManager stay as on main.

npm latest is 0.72.1 (not 0.72.0). 0.72.0 is the minor; 0.72.1 is the current stable patch on that line. No next/canary/beta.

Release notes relevant to us

Web uses defineAgent, defineTool, withEve, eveChannel, and withAuthChallenges for Project image studio (apps/web/agents/image-studio/, apps/web/next.config.ts). We do not import eve/ai, evaluate/decide, evaluationModel/decisionModel, defineInstrumentation, or eve extensions.

0.72.0 (minor, includes 0.71.3 patches from 0.71.2):

• Breaking for evals/instrumentation only: evaluate → decide; evaluationModel → decisionModel; defineInstrumentation action.* → tool.call.*. Does not apply to our image-studio agent.
• Peer ai floor is now ^7.0.128. We already pin ai at 7.0.130; no ai bump.
• Approvals without approval.response are requester-only. Our tools have no custom approval policy; studio auth is a bearer grant.
• Channel/file-delivery, MCP tools: true, tracing, and Web Chat template changes are unused here.

0.72.1 (patch): MCP lazy sign-in and mockModel file-part fix. We do not use MCP connections or mockModel.

Code changes

None in product or tests. The breaking APIs are unused. Typecheck of apps/web (including image-studio agent sources) succeeded against 0.72.1.

Lockfile / overrides

Conflict vs main was pnpm-lock.yaml only (#5836 @evlog/cli 0.9.0). Took main's lockfile and re-ran pnpm install; did not hand-merge. Existing pnpm-workspace.yaml overrides (js-yaml@<4.3.2 → 4.3.2, esbuild@<0.28.2 → 0.28.2) are unchanged.

Evidence

• Before: eve 0.71.2 on main.
  After: eve 0.72.1 exact pin.

Local verification after rebase (all exit 0 so far):

• pnpm check — Biome, 5630 files, 3s, no fixes
• pnpm typecheck — turbo 20/20 tasks, 1m3s, includes web:typecheck

Web tests and web build running after this revision.

Merge Danger

Door: two-way

Pin rollback is eve 0.71.2 plus lockfile restore. No schema, API, or generated-client change.

Blast Radius: image-studio agent runtime

withEve() still mounts /eve/image-studio/v1/*. A runtime regression would hit Project image studio sessions only, not the rest of Web.