chore(web-client): override ws to 8.21.0

[santoshkumarradha]

What

• pins transitive ws to 8.21.0 in control-plane/web/client
• updates pnpm-lock.yaml so the web client no longer resolves ws@8.20.0

Why

GitHub Dependabot is flagging ws@8.20.0 in the web client lockfile (GHSA-96hv-2xvq-fx4p / CVE-2026-48779).

Validation

• cd control-plane/web/client && pnpm install
• cd control-plane/web/client && pnpm test

pnpm test is currently failing for an existing repo issue unrelated to this override:

• src/components/workflow/AgentHealthHeatmap.tsx and src/components/workflow/ExecutionScatterPlot.tsx import date-fns, but date-fns is not present in the package manifest, so Vitest fails during module resolution on the current branch.

Keeping this as draft until CI runs and we decide whether to fix or separately track that pre-existing test failure.

[github-actions]

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface	Current	Baseline	Δ
control-plane	86.90%	87.40%	↓ -0.50 pp	🟡
sdk-go	92.50%	92.00%	↑ +0.50 pp	🟢
sdk-python	93.76%	93.73%	↑ +0.03 pp	🟢
sdk-typescript	90.42%	90.42%	→ +0.00 pp	🟢
web-ui	84.75%	84.79%	↓ -0.04 pp	🟡
aggregate	85.54%	85.75%	↓ -0.21 pp	🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

[github-actions]

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface	Touched lines	Patch coverage	Status
control-plane	0	—	➖ no changes
sdk-go	0	—	➖ no changes
sdk-python	0	—	➖ no changes
sdk-typescript	0	—	➖ no changes
web-ui	0	—	➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.