deps: bump patch and minor dependencies across workspaces

[Aymericr]

What does this PR do?

Bundles every patch/minor upgrade from the 2026-10-14 dependency scan for this repo, with bun.lock regenerated. Upgrades already proposed in #1037 (MCP SDK, three 0.186.1, drei, @react-three/xr, Tailwind/PostCSS, three-mesh-bvh) are deliberately left out to avoid duplicate work.

Package	From	To	Workspaces
@radix-ui/react-* (alert-dialog, context-menu, dialog, dropdown-menu, popover, select, separator, slider, slot, switch, tabs, tooltip)	1.1–2.2	1.2–2.4	editor, apps/editor
lucide-react	^1.7.0	^1.57.0	editor, apps/editor, apps/ifc-converter
zod	>=4.5.4 <4.6	>=4.6.7 <4.7	core, editor, mcp, apps/editor
zustand	^5.0.11	^5.0.15	editor
typescript-eslint	^8.50.0	^8.71.2	eslint-config
eslint-config-prettier / eslint-plugin-only-warn / eslint-plugin-turbo		10.1.8 / 1.2.1 / 2.11.8	eslint-config
manifold-3d	3.5.1	3.5.4	editor
web-ifc	^0.0.77	^0.0.78	ifc-converter, apps/ifc-converter
idb-keyval, dedent		6.3.0, 1.7.2	core
@number-flow/react, geist, react-colorful, tailwind-merge, agentation		0.6.2, 1.7.2, 5.8.1, 3.7.0, 3.1.2	editor, apps/editor
@types/bun, @types/howler, @react-three/test-renderer		1.4.3, 2.2.13, 9.1.1	various

zod keeps its minor cap style (from #747). After install, the MCP SDK resolves to the single root zod 4.6.7 and there is no nested copy, so the two-copies problem behind #747 doesn't come back.

The one source change: the print-shell compiler's CDN fallback (MANIFOLD_VERSION) now points at manifold-3d@3.5.4, so bundled browser builds load the same glue and wasm as the installed package.

How to test

1. bun install (the lockfile should stay unchanged)
2. bun run ci

Screenshots / screen recording

N/A — non-visual change

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

Local results: bun run check, skills:validate, check-types and build pass. turbo run test --continue shows the same 24 local-only failures in editor, nodes and viewer as a clean main checkout in this environment (on GitHub, CI for main is green), and none are new.

  

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d190e9e. Configure here.}