chore(deps): dev-dep security upgrade + drop EOL Node 18 (engines >=20)

[makegov-mark]

Clears all six open Dependabot alerts and raises the Node floor to 20.

Every alert was development-scope — vitest, vite, and esbuild in the test toolchain via package-lock.json; the published package is unaffected (sole runtime dependency remains commander).

What

• vitest 2.1.9 → 4.1.10 and @vitest/coverage-v8 to match (pulls vite 8.2.1, past the vite advisories and the critical vitest UI advisory).
• tsx to the current line, moving esbuild to 0.28.2 (past both esbuild advisories).
• Test-only fix for a vitest 4 breaking change: mock implementations created from arrow functions are no longer constructable with new, so the two constructable CLI test mocks (TangoClient, WebhookReceiver) now use regular-function implementations.
• Node 18 dropped: vitest 4 requires Node ≥20 (uses util.styleText), and Node 18 has been EOL since April 2025 — engines is now >=20.0.0, the CI matrix is 20/22/24, and README/DEVELOPERS say Node 20+. Existing installs on 18 keep working but are no longer tested or supported.

Testing

npm audit: 0 vulnerabilities. Full suite green (358 tests, including the cassette integration layer), coverage run green under vitest 4, both conformance gates exit 0, overlay regen-diff clean, typecheck + lint clean.

Ships in v1.3.0 (engines change is consumer-visible).

• mark 🤖

🤖 Generated with Claude Code