chore(deps): patch remaining esbuild alerts

[santoshkumarradha]

Summary

• pin the web client's npm and pnpm dependency graph to esbuild 0.28.1
• bump examples/ts_agent_nodes/tool_calling from tsx ^4.0.0 to ^4.22.4 so it resolves patched esbuild
• regenerate the affected lockfiles only

Validation

• cd examples/ts_agent_nodes/tool_calling && npm audit --json | jq .metadata.vulnerabilities
• cd control-plane/web/client && npm audit --json | jq .vulnerabilities.esbuild?
• cd sdk/typescript && npm install && npm run build
• cd examples/ts_agent_nodes/tool_calling && npm install && npm test (fails with existing 401 auth responses from the example harness)
• cd control-plane/web/client && pnpm install && pnpm build (fails with existing missing deps for react-hook-form and date-fns in unrelated files)

[github-actions]

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface	Current	Baseline	Δ
control-plane	87.10%	87.40%	↓ -0.30 pp	🟡
sdk-go	92.00%	92.00%	→ +0.00 pp	🟢
sdk-python	93.73%	93.73%	↑ +0.00 pp	🟢
sdk-typescript	90.44%	90.42%	↑ +0.02 pp	🟢
web-ui	84.83%	84.79%	↑ +0.04 pp	🟡
aggregate	85.67%	85.75%	↓ -0.08 pp	🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

[github-actions]

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface	Touched lines	Patch coverage	Status
control-plane	0	—	➖ no changes
sdk-go	0	—	➖ no changes
sdk-python	0	—	➖ no changes
sdk-typescript	0	—	➖ no changes
web-ui	0	—	➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.