fix: resolve Mineflayer uuid security update

[twme-ai]

Problem

The post-merge Dependabot security update for integration/mineflayer failed because Mineflayer 4.37.1 has two transitive uuid constraints:

• @azure/msal-node@2.16.3 requires uuid ^8.3.0
• yggdrasil@1.8.0 requires uuid ^10.0.0

The patched version is uuid 14.0.0+. Dependabot cannot find a safe update path and reports a downgrade to Mineflayer 1.4.0 as its only fix.

Fix

• add package-scoped npm overrides for the two affected dependency edges, pinning uuid@14.0.1
• regenerate the lockfile so both consumers share the patched package
• add a normal CI job that runs npm ci and npm audit for the Mineflayer integration

The override is scoped to the packages identified by the advisory rather than globally forcing unrelated future dependencies.

Verification

• npm ci: passed
• npm audit --audit-level=low: 0 vulnerabilities
• npm ls: both @azure/msal-node and yggdrasil resolve uuid@14.0.1
• CommonJS consumers load and generate valid UUIDs
• mvn -B clean verify: passed
• ./integration/mineflayer/run-e2e.sh: passed on Paper 1.21.11
• actionlint: passed