[w4ffl35]

Summary

Closes #175. Upgrade Zod and the affected body-parser and fast-uri dependency paths. Zod 4 applies bounded parsing to capped arrays, so add explicit limits for previously unbounded mode groups, MCP server lists, custom modes, and queued/message images while preserving deprecated-group handling.

Verification

• npm run typecheck — passed.
• npm run smoke — passed, including the oversized custom-mode regression.
• TMPDIR=/tmp node --import tsx --test src/rsi/__tests__/cli-boundary.test.ts — 2 passed, including isolated snapshot typecheck against committed source.
• npm audit --omit=dev — 0 vulnerabilities; npm ls confirms Zod 4.6.7, body-parser 2.4.0, and fast-uri 3.1.9.
• npm pack --dry-run — passed; 417 files, 1.3 MB package.
• src/security/__tests__/supervisor.test.ts — passed from a short /tmp worktree.
• The local full npm test attempts were not entirely green: the pre-commit run's final snapshot test used pre-change HEAD, and the post-commit run hit the Unix socket path limit in the supervisor test because the scratch path was 130 bytes. The snapshot boundary test passes against committed source, and the supervisor test passes in the short worktree.
• Hosted PR CI runs 40031415197 and 40031398430 both passed the full test suite and E2E at the PR head (17m40s and 22m57s).

Security impact

N/A beyond the dependency and schema changes described above.

Test plan

Run npm ci, npm run typecheck, npm run smoke, npm test, and npm audit --omit=dev.