chore(deps): upgrade Zod while preserving protocol diagnostics

[dependabot]

Upgrades Zod to 4.6.5 while preserving the published App v0/v1/v2 and Module v1/v2 rejection diagnostics. Zod now continues refinements after unknown-key errors; the original bump changed both semantic-error output and union branch diagnostics.

Adds one shared helper at existing refinement boundaries to retain every issue and restore the old unknown-key abort behavior. The portable App Kit ships the same authoritative helper as the host. Removes the workspace Zod 4.4.3 override and regenerates the lockfile, including the packed-consumer dependency. Zod remains outside the routine Dependabot group.

Validation:

• 1,609 before/after App and Module corpus cases: 241 differences before the fix, zero afterward.
• 63 App Kit tests pass, including 16 new diagnostic regressions, unchanged protocol/package-byte tests, and clean external packed consumers.
• The core 15 new App/Module regressions also pass against the former 4.4.3 baseline.
• All 66 shared contract tests pass. Workspace typecheck/build, full web lint, frozen install and dependency audit pass; the dependency graph contains only Zod 4.6.5. Combined validation includes the merged ESLint 10 compatibility fix.
• All required CI passed at 625088e: https://github.com/Maneek21/Deft/actions/runs/35898814944 (API, production image/browser smoke, versioned upgrade, typecheck, lint, build; security workflow also passed).

Decision, trust boundaries, alternatives and rollback: docs/superpowers/plans/2026-09-23-zod-contract-compatibility.md. No data migration or authority changes.