fix(deps): pin production dependencies and update adm-zip

[GFean]

Summary

Related issue or Discussion:

Compatibility and risk

• This change is backward compatible within the documented runtime boundary.
• Breaking behavior is clearly identified in the summary and related issue.
• Resolve, download, apply, rollback, and restart behavior were reviewed when applicable.
• nativeVersion was reviewed for iOS native or podspec changes.
• Backend-contract changes were agreed before implementation.

Validation

• Focused tests cover the behavior change.
• yarn verify:quick passes.
• Relevant bounded native tests pass for Android and/or iOS.
• Coverage thresholds and existing validation gates were not weakened.

Documentation and safety

• Public documentation and examples were updated when behavior changed.
• The PR title follows Conventional Commit format.
• No credentials, signing material, customer data, private endpoints, or generated receipts are included.
• The change is focused and contains no unrelated formatting or generated files.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T20:18:15.479903Z	9eb1619	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.