fix(ci): resync web lockfile blocking Trivy

[groupthinking]

Verified blocker

Security Scan fails before Trivy runs because the Docker build executes:

npm ci --workspace=apps/web --production --legacy-peer-deps

Current package.json and package-lock.json on main are out of sync. npm reports these missing lock entries:

• @opentelemetry/exporter-trace-otlp-http@0.222.0
• @opentelemetry/otlp-exporter-base@0.222.0
• @opentelemetry/otlp-transformer@0.222.0
• @opentelemetry/sdk-trace@2.11.0
• @opentelemetry/sdk-logs@0.222.0
• @opentelemetry/sdk-metrics@2.11.0

Independent reproductions:

• Security Scan 3575, PR test(agents): add SEP-2640 Skills conformance harness #1655
• Security Scan 3576, PR fix(agents): tighten Antigravity input contract #1656

Both affected PRs are Python-only and do not modify package manifests or the lockfile, so this is current-main infrastructure drift rather than a finding in either change.

Acceptance criteria

• regenerate the canonical root/workspace lockfile from current main without unrelated dependency upgrades
• npm ci --workspace=apps/web --production --legacy-peer-deps succeeds
• Docker image build succeeds
• Trivy actually executes and reports a result
• re-run the failed Security Scan jobs on test(agents): add SEP-2640 Skills conformance harness #1655 and fix(agents): tighten Antigravity input contract #1656
• keep any repair draft; no merge or deployment without approval

Safety boundary

Tracking only. No dependency installation, lockfile mutation, merge, or deployment was performed by this issue.

[linear-code]

GRV-483

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.