chore(deps): consolidate October toolchain updates

[lsiddiquee]

Summary

Consolidate the current Dependabot updates without changing product runtime sources or contracts. #106 and #107 split Vitest runners and coverage again despite the existing group; merge them together at 5.0.3 rather than landing either mismatch. Include the independent Ruff 0.16.10 and mypy 2.4.0 lock updates.

Explicitly name the coverage provider in the Vitest group and add a Node CI assertion rejecting unequal runner/provider manifest pins. Record the observed grouping recurrence in docs/06-field-notes.md. No registry URLs committed; preserve 473 unchanged npm integrity hashes.

Validation

• New CI assertion fails on the chore(deps): bump the development-dependencies group with 10 updates #107 state (5.0.2 runners vs 5.0.3 coverage), then passes after consolidation.
• pnpm install --frozen-lockfile; pnpm peers check: pass.
• pnpm -r build; pnpm -r typecheck; pnpm -r lint: pass.
• pnpm -r test:coverage: 847 tests pass; all coverage thresholds pass.
• pnpm --filter @cloakcode/extension package: pass (18-file VSIX).
• poetry check --lock; poetry run ruff check .; poetry run ruff format --check research; poetry run mypy research: pass with exact updated tools.
• pre-commit on all changed files: pass. No new warnings/suppressions; existing Vite chunk-size and unchanged Poetry metadata notices remain baseline.

Guardrails

No runtime workspace upload/sync or new egress path; package boundaries, protocol ownership, localhost/auth/provenance/redaction behavior unchanged. No actuator abstractions or release/publication. Repository-source push/merge only, authorized by the maintainer.

Closes #106
Closes #107
Closes #108
Closes #109