Lands four SAFE-MERGE Dependabot bumps in one commit. Each was confirmed SAFE-MERGE by the H' triage on PR #155, then re-verified locally on the new lockfile baseline (vitest@3 + vite@8 + esbuild dropped) from PR #159. - @react-three/fiber 9.6.0 → 9.6.1 (closes #148) - @vitejs/plugin-react 5.x → 6.0.1 (closes #147) - jsdom 25.x → 29.1.1 (closes #144) - vite pinned to >=8.0.12 via pnpm.overrides (closes #145) 37/37 bus + 101/101 hud tests; both workspaces build; production webview bundle stamps cleanly. PR #146 (TypeScript 6) NOT included; deferred for focused evaluation.