Lands four SAFE-MERGE Dependabot bumps in one commit. Each was confirmed SAFE-MERGE by the H' triage on PR #155, then re-verified locally on the new lockfile baseline (vitest@3 + vite@8 + esbuild dropped) from PR #159.
- @react-three/fiber 9.6.0 → 9.6.1 (closes#148)
- @vitejs/plugin-react 5.x → 6.0.1 (closes#147)
- jsdom 25.x → 29.1.1 (closes#144)
- vite pinned to >=8.0.12 via pnpm.overrides (closes#145)
37/37 bus + 101/101 hud tests; both workspaces build; production webview bundle stamps cleanly. PR #146 (TypeScript 6) NOT included; deferred for focused evaluation.