fix: keep the validate and release gates green

- refresh dependency overrides so the audit gate passes again
  (protobufjs 7.6.4 -> 7.6.6, undici 8.5.0 -> 8.10.2, new
  brace-expansion override 5.0.9). npm run validate is green again:
  typecheck, 1229/1230 tests, 0 vulnerabilities, pack clean.
- promote the 0.22.0-evandro.1 changelog section from "###" to "##" so
  .github/workflows/release.yml can build release notes for the tag.
  The previous Release run failed with "CHANGELOG.md has no section for
  0.22.0-evandro.1".
- record both fixes under "## Unreleased".

package-lock.json

@@ -963,7 +963,6 @@
       "version": "26.1.1",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
       "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.3.0"
@@ -1363,14 +1362,16 @@
       "peer": true
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.6",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/buffer-equal-constant-time": {
@@ -1879,7 +1880,9 @@
       }
     },
     "node_modules/protobufjs": {
-      "version": "7.6.4",
+      "version": "7.6.6",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz",
+      "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==",
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
       "peer": true,
@@ -1900,19 +1903,6 @@
         "node": ">=12.0.0"
       }
     },
-    "node_modules/protobufjs/node_modules/@types/node": {
-      "version": "22.19.19",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "undici-types": "~6.21.0"
-      }
-    },
-    "node_modules/protobufjs/node_modules/@types/node/node_modules/undici-types": {
-      "version": "6.21.0",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/retry": {
       "version": "0.12.0",
       "license": "MIT",
@@ -2037,7 +2027,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.5.0",
+      "version": "8.10.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.10.2.tgz",
+      "integrity": "sha512-/y4/bH9YNU5hi9NIrpOuvGXFcxrj3CMrV+/AYpowAYTpHn8gX/XPFjNy766FPoYY0miQhdW977JFWKGNhBdwyQ==",
       "license": "MIT",
       "peer": true,
       "engines": {
@@ -2048,7 +2040,6 @@
       "version": "8.3.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
       "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/web-streams-polyfill": {