[mswilkison]

The default-branch development lockfile contains 113 Dependabot alerts. This refresh removes affected-version matches for 112 of them while preserving Hardhat 2.19.4, ethers 6.10.0, hardhat-deploy 0.11.45, the helper API, and existing peer requirements.

• Upgrade the direct Mocha runner and refresh vulnerable transitive packages. Keep Axios 0.x/1.x, ws 7.x/8.x, and minimatch majors separate; add selective resolutions where upstream packages still pin vulnerable versions.
• Refresh Cognito within its existing 6.x range so patched js-cookie 3 works with its actual import and storage APIs.
• Make CI read the existing Node 20 .nvmrc and enforce frozen lockfile installation. PR validation uses the built-in checkout token; publishing events still require the existing custom token. This fixes the existing PR checkout failure when that custom secret is unavailable.
• Add eight focused compatibility/regression tests for Hardhat RPC and compiler downloads, archive extraction, legacy Axios multipart redirects, ethers signing, temporary files, Mocha serialization/diffs, and Cognito cookie storage.

This is a separate dependency fix against main. Existing maintenance PRs #6 and #7 change helper behavior and packaging but do not already cover this lockfile refresh. Their lockfiles will need to incorporate this update when those changes are integrated.

Validation on Node 20.20.2 / Yarn 1.22.22:

• yarn install --frozen-lockfile, yarn build, yarn test (50 passing), and yarn format passed.
• GitHub CI passed at 6793e942893515126813ac7f10ad9dfd18e18cb7: test/format and build/test.
• Compiled dist/ is byte-for-byte identical to the baseline; package contents were checked with npm pack --dry-run --ignore-scripts.
• The critical Elliptic malformed-signing trigger accepted a negative hex message and an invalid byte array before the update; both are rejected after it. A valid signing/verification control passes before and after.
• Compared the complete lockfile with all version branches of the 113 supplied advisories: only #48 / GHSA-848j-6mx2-7j84 still matches. Elliptic 6.6.1 fixes its critical advisories, but no upstream version fixes that remaining low-severity advisory.

yarn audit is intentionally not described as clean: it reports the remaining Elliptic advisory and a registry-name malware advisory for eslint-config-keep. The latter package is fetched from the unchanged Keep GitHub configuration commit 0c27ade54e725f980e971c3d91ea88bab76b2330, not the npm registry package covered by that advisory; its configuration and lifecycle metadata were inspected.

These are development-tree updates. They do not update independently installed consumers or establish that every vulnerable behavior is unreachable. Custom authentication headers still require an explicit redirect policy at the calling application boundary; a follow-redirects version bump alone should not be treated as that policy.