chore(deps): declare wreq-js as optional TLS runtime dependency

[yansigit]

Summary

Declares wreq-js@2.3.1 as an optionalDependency (plus lockfile entries) so the opt-in Antigravity TLS profile in #3741 has its runtime available where the operator enables it. Split out of #3741 at maintainer request: the transport plumbing ships dependency-free, this PR carries only the supply-chain surface.

Verifiable facts in this change:

• Exact pin 2.3.1 with integrity sha512-vaKasaKeskrDKEuuO5Q5uamEG9a6FrF5ZSicH7TCvYS4RxF7/gzaU/vYqwJzcs+uydyJPVWY1KCvfVCgp0tiGA==.
• Lockfile platform matrix: os: [linux, win32, darwin], cpu: [x64, arm64].
• The runtime is loaded only through a lazy dynamic import inside the opt-in profile path; nothing requires it at startup, and without it the profile fail-closes (failed status, send refused).

Supply-chain notes for sign-off (blocked on lidge-jun):

• Provenance: source at github.com/sqdshguy/wreq-js (Node/NAPI bindings over the Rust wreq HTTP/TLS-impersonation crate); npm tarball https://registry.npmjs.org/wreq-js/-/wreq-js-2.3.1.tgz, shasum f4a2243acf0edd037625c77397a91457a92d2fd9; exact pin 2.3.1 with the integrity hash above.
• Linkage: NAPI native binding, prebuilt per-platform artifacts selected via the lockfile matrix (os: darwin/linux/win32, cpu: x64/arm64); no build step on install, no postinstall scripts.
• Fallback: optionalDependencies — if the install fails on a target, the lazy import("wreq-js") in providerTlsFetch throws, the profile status goes failed, and the send is refused as a transport error; providers without tlsProfile keep using the default fetch path, so the proxy is otherwise unaffected.

Verification

• git diff --stat: 8 insertions across package.json and bun.lock, no code changes.
• Manifest-only change; hosted CI at the exact head is the evidence.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Third box is intentionally unchecked: this PR exists to request the supply-chain security review.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d3c4799e-43a4-43a8-8bff-266cb0e9acd7

📥 Commits

Reviewing files that changed from the base of the PR and between 3d5efc7 and 8f1a60a.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• package.json

 _____________________________________________________
< Code Wars Episode III: Revenge of the Shared State. >
 -----------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

Automatic draft conversion failed (token cannot change draft status). Please convert this pull request to a draft manually. The required enforce-target check will keep failing until every issue above is resolved.