fix(deps): clear 4 osv-scanner advisories (brace-expansion, bedrock-agentcore)

[isadeks]

Problem

The security:deps job has been failing on main itself since the 2026-07-06 scheduled run (also 07-13, 07-20), on advisories published against already-resolved dependencies rather than anything a PR changed. Because the gate runs per-PR, it currently fails every open PR as a side effect — e.g. #653, which touches no lockfile or manifest at all.

Total 4 packages affected by 4 known vulnerabilities (0 Critical, 4 High, 0 Medium, 0 Low)

| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE           | VERSION | FIXED   |
| https://osv.dev/GHSA-j6g5-3hh3-pgw8 | 8.4  | PyPI      | bedrock-agentcore | 1.17.0  | 1.18.1  |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion   | 1.1.16  | 5.0.8   |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion   | 2.1.2   | 5.0.8   |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion   | 5.0.7   | 5.0.8   |

Fix

brace-expansion (GHSA-mh99-v99m-4gvg, 7.5) — DoS via unbounded expansion length causing an OOM crash. Three ranges were in the tree (^1.1.7, ^2.0.2, ^5.0.5, via minimatch 3.x / 9.x / 10.x), resolving to 1.1.16 / 2.1.2 / 5.0.7.

The advisory covers everything <= 5.0.7, so the v1 and v2 lines have no patched release inside their own majors — a plain lockfile re-resolve cannot fix them, which is why this needs a resolutions entry rather than the usual re-resolve-only change. "brace-expansion": "^5.0.8" collapses all three ranges onto the patched version. The package is transitive-only; nothing declares it directly.

bedrock-agentcore (GHSA-j6g5-3hh3-pgw8, 8.4) — improper neutralization of argument delimiters in the Python SDK's install_packages(). This one is exact-pinned in agent/pyproject.toml, so it is a deliberate 1.17.0 → 1.18.1 bump (1.18.1 is both the first patched version and the current latest).

Verification

• osv-scanner across all three lockfiles: No issues found (was 4 High).
• mise run build green — cdk 2526 tests / cli / agent 1298.
• The bumped SDK's one runtime touchpoint — BedrockAgentCoreContext.set_workload_access_token, used by the workload-token bridge in agent/src/server.py — was checked to still exist in 1.18.1. Worth calling out because the agent tests mock that import, so the suite passing alone would not have proven it.

Lockfile + pin only; no source changes.

Follows the same shape as #637 and #639.