[codex] fix(deps): resolve open dependabot alerts

[aron23]

What changed

This PR resolves the currently open Dependabot alerts that map to the cdk and ts manifests.

• cdk/package.json now overrides vulnerable transitive flatted and picomatch versions.
• cdk/requirements-build.txt bumps setuptools to 80.10.1 and wheel to 0.46.2.
• ts/package.json updates the vulnerable fast-xml-parser override to 5.5.9 and adds safe overrides for flatted and yaml.
• cdk/package-lock.json and ts/package-lock.json were regenerated from those manifest changes.

Why

GitHub currently reports 8 open Dependabot alerts on the default branch for these packages:

• cdk/package-lock.json: flatted, picomatch
• cdk/requirements-build.txt: setuptools, wheel
• ts/package-lock.json: flatted, fast-xml-parser, yaml

Impact

This keeps the dependency remediation small and scoped to the alerting manifests while preserving the existing release line on staging.

Validation

• make test
• Verified the branch is a fast-forward from origin/staging
• Rehearsed a no-commit merge of this branch into origin/premain; it merged cleanly with no conflicts

Notes

npm audit still reports residual moderate issues outside the current GitHub alert set, including brace-expansion and the aws-cdk-lib-embedded yaml copy in cdk. Those were not part of the 8 open Dependabot alerts addressed here.