Bump sharp to 0.35.x to resolve Dependabot alert (requires libvips compliance review)

[adilei]

Background

PR #34 resolves 14 of the 15 open Dependabot alerts (tar, adm-zip, fast-uri). The remaining alert — sharp (high severity) — was intentionally split out because it cannot be landed mechanically.

Why sharp needs its own PR

Bumping sharp ^0.34.5 → ^0.35.x also bumps the bundled libvips native library (@img/sharp-libvips-*) from 1.2.4 → 1.3.2. This trips the deliberate license-compliance gate:

• third_party/compliance-policy.json pins the exact reviewed versions (sharp: 0.34.5, sharpLibvips.version: 1.2.4).
• scripts/compliance.mjs (validateReviewedVersions) fails CI with sharp versions have not been reviewed: 0.35.x; expected 0.34.5.
• RELEASING.md documents that Sharp / sharp-libvips bumps require human review of licenses, native dependency versions, patches, source archives, and relinking.

What the sharp PR must do

• Bump sharp to the target 0.35.x in package.json and add "sharp": "$sharp" to overrides (forces the transitive copy under @huggingface/transformers to match).
• Update third_party/compliance-policy.json: sharp version, sharpLibvips.version (1.3.2), and the ~40 sourceMaterials SHA-256 hashes for the new libvips component versions (aom, cairo, glib, vips, etc.).
• Regenerate THIRD-PARTY-NOTICES.md.
• Fix the frame extractor type for the sharp 0.35 export split: electron/frames/extractor.ts needs type Sharp = (typeof import("sharp"))["default"]; (0.35 splits the import/require export conditions, so the namespace form is no longer callable).
• Add a regression test in electron/frames/extractor.test.ts guarding the createRequire load path stays a callable factory (.extract().jpeg() pipeline).
• Run npm run typecheck, npm test, and npm run compliance:licenses; confirm the version-review gate passes.

References

• Dependabot alerts: https://github.com/microsoft/skill-recorder/security/dependabot
• Split rationale: PR Fix 14 open Dependabot alerts (tar, adm-zip, fast-uri) #34

[adilei]

Draft PR with the mechanical starting point + a compliance-review checklist is up: #36 (assigned to Giorgio Ughini (@GiorgioUghini)). CI is red by design until the libvips 1.3.2 native review + @img/sharp-wasm32 tooling decision are done.