deps: remove unused puppeteer-core; bump transformers/marked/socks

Completes the #2582 split (ENG-OV8). puppeteer-core had ZERO imports
repo-wide — a dead direct dependency whose only footprint was its CVE-prone
transitive chain (puppeteer-core > @puppeteer/browsers > proxy-agent >
get-uri > basic-ftp) and the pin test + basic-ftp override that existed
solely to guard it. Removing the dependency removes the surface: the
basic-ftp override and test/basic-ftp-security-pin.test.ts retire with it
(the lockfile resolves zero basic-ftp copies now). transformers ^4.2.0,
marked ^18.0.9, socks ^2.8.9 land per the dependabot group, gated on the
ONNX sidecar load+classify smoke passing with the bumped transformers
(28/28 sidecar+classifier+security tests green post-bump).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

package.json

@@ -51,15 +51,14 @@
     "slop:diff": "bun run scripts/slop-diff.ts"
   },
   "dependencies": {
-    "@huggingface/transformers": "^4.1.0",
+    "@huggingface/transformers": "^4.2.0",
     "@ngrok/ngrok": "^1.7.0",
     "cross-spawn": "^7.0.6",
     "diff": "^9.0.0",
     "html-to-docx": "1.8.0",
-    "marked": "^18.0.2",
+    "marked": "^18.0.9",
     "playwright": "^1.62.1",
-    "puppeteer-core": "^24.40.0",
-    "socks": "^2.8.8"
+    "socks": "^2.8.9"
   },
   "engines": {
     "bun": ">=1.0.0"
@@ -81,8 +80,7 @@
     "xterm-addon-fit": "^0.8.0"
   },
   "overrides": {
-    "adm-zip": "^0.6.0",
-    "basic-ftp": "5.3.1"
+    "adm-zip": "^0.6.0"
   },
   "patchedDependencies": {
     "playwright-core@1.62.1": "patches/playwright-core@1.62.1.patch"