fix(security): eliminate Rust and npm dependency advisories

[ruvnet]

Summary

• refresh every committed Rust lockfile and remove stale nested workspace locks
• eliminate all actionable RustSec advisories across 50 lockfiles
• make the npm dependency graph reproducible and audit-clean, including dev dependencies
• retire the vulnerable/unmaintained optional GunDB edge backend while preserving a local compatibility fallback
• remove wee_alloc, upgrade pprof/tract/prometheus and other security-sensitive dependencies
• make DSPy an optional peer instead of installing its currently vulnerable transformer stack
• harden RuVocal production dependencies, replace vulnerable Thrift-backed Parquet output, and preserve string UUID typing across the secure UUID upgrade
• repair and version the distributable packages affected by this work:
  • @ruvector/spiking-neural 1.0.3
  • @ruvector/agentic-synth 0.1.7
  • @ruvector/burst-scaling 1.0.2
  • ruvbot 0.3.3
• restore the missing spiking-neural JS implementation with optional native SIMD acceleration
• fix burst-scaling's published entry point so its compiled dist artifact is actually included
• fix optional-module TypeScript builds and agentic-synth ESM/CLI version handling

Security validation

• cargo audit across 50 committed lockfiles: 0 actionable vulnerabilities
• fresh npm install --package-lock-only with no existing node_modules: 0 vulnerabilities
• reproducible npm ci --ignore-scripts --force: pass
• full npm audit --audit-level=low: 0 vulnerabilities
• RuVocal production audit: 0 high/critical advisories; Parquet write smoke: pass

Build validation

• root cargo fmt --all -- --check
• root workspace checks completed for dependency changes
• cargo check --manifest-path examples/data/Cargo.toml --workspace
• ONNX WASM, edge all-features, and ruvLLM metrics checks
• spiking-neural: 12/12 tests + native node-gyp build
• agentic-synth: typecheck + all ESM/CJS/declaration builds + CLI smoke
• burst-scaling: TypeScript build + packed-tarball isolated install/require smoke
• ruvbot: CJS and ESM builds
• cognitum-gate-wasm and ruvector-wasm-unified builds/tests
• git diff --check

Notes

The GunDB feature name remains accepted for compatibility, but now uses the maintained local transport. This avoids shipping the vulnerable ring/tungstenite/nix stack from the unmaintained backend.

RuVocal's existing Svelte diagnostics remain at the main-branch baseline (186 errors); this change introduces no new diagnostics.

Closes #736