fix: Node profiler crash on init by pinning @datadog/pprof to dd-trace 5.105's required version

[joeyzhao2018]

Summary

Pins three layer-bundled dependencies in package.json to the exact versions/ranges that dd-trace@5.105.0 declares in its optionalDependencies. The important one is @datadog/pprof, which was resolving to a stale
5.13.2 and breaking profiler startup on Node.

Background / root cause

The serverless Node layer bundles whatever scripts/move_ddtrace_dependency.js promotes from devDependencies into dependencies at build time — namely dd-trace, @datadog/pprof, @opentelemetry/api, and @opentelemetry/api-logs. These ship at the top level of the layer's node_modules, so they shadow dd-trace's own nested copies.
@datadog/pprof was declared as "*", which yarn.lock had pinned to 5.13.2. Meanwhile dd-trace@5.105.0 pins @datadog/pprof@5.14.4 in its optionalDependencies. The two versions have an incompatible SourceMapper API:

• 5.13.2 — only a static SourceMapper.create(searchDirs) factory.

• 5.14.4 — adds an async loadDirectory(searchDir) instance method.

  dd-trace@5.105's profiling/profiler.js calls new SourceMapper(...).loadDirectory(process.cwd()). Against the hoisted 5.13.2, that throws at profiler startup:

  Error: Error starting profiler. (https://dtdg.co/nodejs-profiler-troubleshooting)
    at Tracer._startProfiler (.../dd-trace/src/proxy.js:258:11)
  TypeError: mapper.loadDirectory is not a function
    at ServerlessProfiler.start (.../dd-trace/src/profiling/profiler.js:173:14)

The profiler never starts, so the datadog.profiling.agent metric is never emitted. This was caught by the serverless-e2e-tests test_profiling_usage failing for all Node versions after the dd-trace 5.93→5.105
bump.

Changes (package.json devDependencies)

Each value now matches dd-trace@5.105.0's optionalDependencies exactly:

Dependency	Before	After	dd-trace 5.105 requires
@datadog/pprof	"*" (→ 5.13.2)	"5.14.4"	5.14.4
@opentelemetry/api	"*"	">=1.0.0 <1.10.0"	>=1.0.0 <1.10.0
@opentelemetry/api-logs	"*"	"<1.0.0"	<1.0.0

dd-trace itself was already ^5.105.0 and is unchanged.

@opentelemetry/api / api-logs were not actually broken (their "*" already de-duped with dd-trace's ranges to 1.9.0 / 0.208.0), but they're pinned to the same ranges dd-trace declares so the layer can't drift past
dd-trace's supported range in a future install (e.g. pulling otel-api ≥1.10).

yarn.lock is regenerated: the duplicate @datadog/pprof@* (5.13.2) specifier collapses into the single @datadog/pprof@5.14.4 entry.

Verification

• e2e tests passed!
• Top-level @datadog/pprof now resolves to 5.14.4, and it is the only copy of pprof in node_modules (no stale 5.13.2 remaining).
• The loadDirectory instance method is present in the resolved pprof.
• After rebuilding the layer, move_ddtrace_dependency.js promotes @datadog/pprof@5.14.4, so /opt/nodejs/node_modules/@datadog/pprof ships with loadDirectory and the profiler starts cleanly.