[wtgodbe]

Summary

Address the shared npm audit --audit-level=moderate failure in Agent Harness Coverage observed on #39400 and #39409. The vulnerable dependency graph is already present on main; neither PR introduced it.

• Refresh compatible transitive dependencies: body-parser 2.4.0, fast-uri 3.1.9, qs 6.16.1, and Zod 4.6.7.
• Add a temporary override scoped to @github/copilot-sdk@1.0.15, which otherwise pins vulnerable Zod 4.3.6. The patched Zod is deduplicated across the graph; remove the override when the upstream SDK pin is patched.
• Keep Vally and Vally CLI at 0.19.0. No workflow, Dependabot, registry configuration, or credential changes are included. Both manifest and lockfile remain repository-owned; the lockfile was regenerated using npm.

Feed ingestion blocker

This PR is a draft because ingestion is not complete.

The requested target is dnceng/public/dotnet-public-npm. fast-uri 3.1.9, qs 6.16.1, and Zod 4.6.7 were downloaded through that feed using fresh caches, and their archive integrity matches both this lockfile and npmjs.

body-parser 2.4.0 exists on npmjs but returns 404/not-found through the selected feed. Authenticated npm resolution, npm cache add, installation, and the documented Azure Artifacts content-download API could not retrieve it. The feed reports a healthy npmjs upstream and the caller has the Collaborator role; 2.4.0 is not present even when including deleted versions. The underlying feed-side cause is not yet established. No feed policy was changed and no package was manually republished.

Keep the PR in draft until body-parser 2.4.0 has also been saved from npmjs into the selected feed and its archive integrity verified.

Validation

• Clean npm ci using the public npmjs registry succeeds under Node 24.22.1.
• npm audit --audit-level=moderate --registry=https://registry.npmjs.org: zero vulnerabilities.
• npm test: 69 passed, none failed or skipped.
• npm run lint: passed for all 18 components.
• Copilot SDK import/tool construction, shared patched-Zod resolution, Zod JSON-schema conversion, and handler smoke checks passed without starting a Copilot session.

Separately, Dependabot already updates /eng/harness-evaluation weekly on Monday; adding a duplicate npm configuration is unnecessary. Automated security-update settings, upstream exact pins, and feed-ingestion automation can be investigated independently of this dependency fix.