#8844 fix(deps): bump zod to 4.6.6 to resolve Dependabot alerts

Summary

Bumps zod 4.6.5 → 4.6.6 in every workspace manifest that pins it (8 apps, 13 packages). Lockfile refreshed.

Alerts resolved, all high: "Zod can exhaust memory while validating oversized constrained collections" (< 4.6.6):

• apps: #423 (api), #424 (desktop), #425 (docs), #426 (gate), #427 (marketing), #428 (mobile), #429 (usercontent), #430 (web)
• packages: #431 (auth), #432 (chat-runtime), #433 (chat), #434 (cli), #435 (db), #436 (email), #437 (host-service), #438 (local-db), #439 (mcp), #440 (sandbox), #441 (shared), #442 (trpc), #443 (ui)

This also replaces #8825 (packages/mcp) and #8824 (packages/sandbox). They bump one directory each, so Sherif's multiple-dependency-versions check fails on both. The zod pin can only move in all workspaces at once.

@agentclientprotocol/claude-agent-acp pins zod 4.6.5 exactly, so the lockfile keeps one nested 4.6.5 copy for it. A manifest bump here cannot change that; it needs an upstream release.

Not in this PR (already covered by open PRs):

• next, @sentry/nextjs, vite: #8821
• storybook, @modelcontextprotocol/sdk, hono: #8776, plus #8740, #8696, #8693 and #8695 for the manifests #8776 leaves out
• @azure/msal-node 5.5.0 → 7.1.0 (#444): #8836

Test plan

• bun install (Bun 1.4.3, the repo's packageManager); Sherif postinstall clean, native modules rebuilt
• bun run lint:fix (clean, no fixes)
• bun run lint (clean)
• bun run typecheck (root, all workspaces)
• CI

Summary by CodeRabbit

• Chores
  • Updated the data-validation library to version 4.6.6 across the product suite. No user-facing feature or behavior changes are noted in this update.