Stabilize Dependabot npm lockfile updates

[nawforce]

Summary

Dependabot's npm lockfile refreshes were dropping the optional Lighthouse/proxy-agent peer dependency subtree, so CI's npm ci rejected the lockfile as out of sync.

This PR:

• pins the package manager metadata to npm@10.9.8, matching the CI npm used in the failing checks
• adds proxy-agent@8.0.2 as an explicit optional dependency so npm treats the Lighthouse proxy peer tree as part of the root install plan instead of an incidental nested peer tree
• groups the Chai assertion stack in Dependabot so related peer-dependent majors are proposed together instead of split across incompatible PRs

Verification

• npx npm@10.9.8 ci
• npm run build
• npm test passed with elevated filesystem access for Salesforce CLI logs under ~/.sf

The initial sandboxed npm test run failed only because the Salesforce CLI attempted to write /Users/kevinjones/.sf/sf-2026-07-09.log, which is outside the workspace sandbox.