[codex] Fix npm audit vulnerabilities

[next-devin]

Summary

• Refresh package-lock to resolve npm audit findings
• Bumps liquidjs to 10.25.7, picomatch to 2.3.2, and brace-expansion to 5.0.5 through npm audit fix
• Leaves package.json unchanged

Why

The v0.1.1 package had audit findings in LiquidJS plus transitive glob dependencies. LiquidJS is a core renderer dependency, so clearing this is useful before broader agency/developer distribution.

Validation

• npm audit --json: 0 vulnerabilities
• npm test: 165 passing

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!