[Story]: Bring lightbridge-opencode-toolbeit dependencies up to current

## Summary

A dependency-freshness audit of `lightbridge-opencode-toolbeit` (12 `package.json` files across `apps/browser-extension` and the `packages/opencode-*` workspace) found 16 of 54 direct dependencies behind current npm `latest`: 4 by a major version and 12 by a minor. The OpenTelemetry family (11 packages) is already fully current — no action needed there.

## Intent

Source of truth: ADORSYS-GIS/ai-helm#1002 (org-wide JS/TS dependency freshness audit).

The Vercel AI SDK pair (`ai` + `@ai-sdk/openai`) is two major versions behind, which is the one genuinely risky item here — everything else is routine minor-version catch-up.

## Scope

All version numbers are from the npm registry (`registry.npmjs.org//latest`), checked 2026-08-13.

### Batch A — routine (minor, low risk)

| package | current | latest | delta |
|---|---|---|---|
| `@biomejs/biome` | 2.4.15 | 2.5.8 | minor |
| `@modelcontextprotocol/sdk` | ^1.29.0 | 1.30.0 | minor |
| `@opencode-ai/plugin` | 1.15.10 | 1.18.18 | minor |
| `@types/chrome` | ^0.1.43 | 0.2.5 | minor |
| `builtin-modules` | ^5.0.0 | 5.3.0 | minor |
| `cron-parser` | ^5.5.0 | 5.8.1 | minor |
| `cronstrue` | ^3.20.0 | 3.24.0 | minor |
| `daisyui` | ^5.5.23 | 5.7.16 | minor |
| `papaparse` | ^5.5.3 | 5.6.0 | minor |
| `rolldown` | ^1.0.2 | 1.2.4 | minor |
| `tree-sitter` | ^0.21.1 | 0.25.1 | minor (0.x, treat cautiously) |
| `vite` | ^8.0.14 | 8.2.1 | minor |

- [ ] Bump each independently except: `cron-parser` + `cronstrue` (both scheduling-related, low risk to test together), and `rolldown` + `vite` (rolldown-vite integration — verify the build still resolves after bumping both).
- [ ] `tree-sitter` 0.21→0.25 is a native binding; re-check against `tree-sitter-typescript` (currently current at `^0.23.2`) for ABI compatibility before merging — 0.x packages don't follow strict semver guarantees.

### Batch B — needs a real look (major version behind)

| package | current | latest | delta |
|---|---|---|---|
| `ai` | ^5.0.199 | 7.0.64 | MAJOR (2 majors behind) |
| `@ai-sdk/openai` | ^2.0.106 | 4.0.41 | MAJOR (2 majors behind) |
| `@types/node` | ^25.9.1 | 26.2.0 | MAJOR |
| `typescript` | ^6.0.3 | 7.0.2 | MAJOR |

- [ ] **Vercel AI SDK pair** — `ai` and `@ai-sdk/openai` are versioned in lockstep; bump both together, not independently. Two major versions is a real migration (provider/tool-call API surface has changed release-over-release) — needs a dedicated review of every call site that uses `ai`'s streaming/tool-call APIs, likely in the MCP/devtools packages.
- [ ] `@types/node` — bump to match whatever Node major the browser-extension build and CLI tooling actually target.
- [ ] `typescript` 6→7 — TypeScript 7 is the native (Go-ported) compiler. Given this repo already tracks TS 6.x (ahead of most of the org, which is still on 5.x), validate the Biome/rolldown/vite toolchain against TS 7 before committing — may warrant its own spike.

## Out of scope

- No behavior changes to the browser extension, MCP servers, or devtools beyond what the majors force.
- No re-architecture of the `ai`/`@ai-sdk/openai` call sites beyond what's needed to compile against the new major.

## Risk assessment

- **Highest risk:** the Vercel AI SDK pair (`ai` + `@ai-sdk/openai`), two majors behind — this is the one item in this Story that needs real engineering time, not just a version bump.
- Everything else in Batch A is low-risk and safe to batch into one PR.
- No deprecated packages found in this repo's dependency set.

## Verification

- [ ] `bun install` (or the repo's package manager) resolves cleanly with no peer-dependency errors after each batch.
- [ ] Turbo/workspace build passes for every `packages/opencode-*` workspace.
- [ ] Browser extension (`apps/browser-extension`) builds and loads unpacked without console errors.
- [ ] Manual smoke test of at least one AI-SDK-backed feature (tool-call flow) after the `ai`/`@ai-sdk/openai` bump.

```
# commands to run for verification once the bumps land
bun install
bun run build # or turbo run build, per repo tooling
```

## AI Usage Declaration

- [x] Drafting this story
- [x] Suggesting implementation
- Versions were pulled programmatically from the npm registry (`registry.npmjs.org//latest`), not fabricated or estimated.
- No code was generated or changed as part of filing this Story — it is audit + planning only.

## Reviewer Focus

Please confirm scope of the Vercel AI SDK migration (Batch B) before estimating — a 2-major jump on `ai` can hide breaking changes in streaming/tool-call handling that a `bun install` alone won't surface.