chore(deps): bump qs and fast-uri to clear the production dependency audit

[Joob1n]

Summary

npm audit --omit=dev reports two advisories against production dependencies: qs@6.15.3 (moderate — array-limit bypass via bracket-key comma parsing; DoS via attacker-controlled isBuffer), reached through @larksuiteoapi/node-sdk in @maka/runtime, and fast-uri@3.1.x (high — host confusion and SSRF via IDN, IPv6 and percent-decoding normalization; GHSA-5jgf-p345-68v8 and siblings). The Build CLI release candidate step and the Dependency audit workflow fail on any such advisory, so every PR on main currently fails regardless of its content (e.g. https://github.com/apache/maka/actions/runs/33648229722, https://github.com/apache/maka/actions/runs/33655577529). qs resolves to 6.16.0 and fast-uri to 3.1.7; the production dependency notices (Desktop and CLI) are regenerated for the new versions.

Verification

npm audit --omit=dev --audit-level=moderate → clean; npm audit --omit=dev --workspace maka-agent --json → total: 0; npm run check:third-party-notices and npm run check:cli-third-party-notices → clean. No source changes.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code — diagnosis and the lockfile bump; verified by the author.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

[Astro-Han]

LGTM.

[Joob1n]

The remaining test failure is the Desktop e2e transcript-scroll.spec.ts:251, a main regression introduced by #4184 and hidden until now because every main push has been dying at the production audit this PR fixes — bisected on clean checkouts and reported on #4184. Nothing in this PR touches the renderer; once #4184's regression is fixed this should go green on rebase.