fix(deps): replace vulnerable xlsx release

[alexandroit]

Why

AgentLang uses xlsx in src/api/http.ts to generate evaluation workbooks. The npm xlsx@0.18.5 release is affected by GHSA-4r6h-8v6p-xvw6 (prototype pollution) and GHSA-5pgg-2g8v-p4x9 (ReDoS).

This changes only the dependency resolution:

"xlsx": "npm:@stackline/xlsx@^1.0.6"

The package remains available as xlsx, so the existing import * as XLSX from 'xlsx' and workbook export code do not change. @stackline/xlsx is an independent, maintained SheetJS-compatible fork with regression tests for both advisories. It requires Node 20+, which matches AgentLang's node >=20.0.0 contract.

Disclosure: I maintain the Stackline fork. A neutral alternative is SheetJS CE 0.20.3 from the official tarball.

Validation

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm test: 429 passed
• pnpm build: passed
• pnpm lint: passed with one pre-existing generated-file warning
• XLSX write/read round-trip: passed
• malicious __proto__ / constructor worksheet headers: no Object.prototype pollution
• pnpm why xlsx: resolves xlsx <- @stackline/xlsx@1.0.6

Only package.json and pnpm-lock.yaml are changed.