Upgrade Puppeteer to remove vulnerable extract-zip chain

[konard]

Reproduction

@link-assistant/web-capture@1.11.2 declares puppeteer: ^24.8.2. A clean
consumer lock currently resolves Puppeteer 24 and its
@puppeteer/browsers -> extract-zip@2.0.1 chain:

workdir="$(mktemp -d)"
cd "$workdir"
npm init -y
npm install --package-lock-only @link-assistant/web-capture@1.11.2
npm audit --package-lock-only --audit-level=high

The audit exits non-zero for GHSA-8jqr-rrrh-j9v7, the extract-zip path
traversal advisory. extract-zip has no release newer than 2.0.1, so updating
inside Puppeteer 24 cannot clear the finding.

Workaround

Consumers can apply a scoped npm override for the two browser packages and run
their normal web-capture tests:

{
  "overrides": {
    "@link-assistant/web-capture": {
      "puppeteer": "^25.7.0",
      "puppeteer-core": "^25.7.0"
    }
  }
}

Puppeteer 25 uses @puppeteer/browsers 3, whose archive implementation no
longer depends on extract-zip. link-assistant/formal-ai validated the override
with its desktop and VS Code suites while fixing #1014.

Suggested code fix

Move puppeteer and puppeteer-core to the compatible 25.x line, exercise both
capture engines in CI, and add npm audit --package-lock-only --audit-level=moderate as a required gate so future transitive advisories do
not remain install-time text with a successful exit code.

[konard]

Downstream packaging found two compatibility constraints beyond the clean unit
suites reported above:

1. A server-side esbuild cannot inline Playwright. Puppeteer 25 resolves
   chromium-bidi@17, while Playwright retains optional private
   chromium-bidi/lib/cjs/... imports; esbuild follows those dead paths and
   fails. Playwright documents bundling as unsupported in
   [Bug]: 1.48.0 missing chromium-bidi dependency microsoft/playwright#33031. The working consumer
   configuration externalizes playwright and playwright-core and ships them
   as ordinary production packages.
2. web-capture's current browser-commander@^0.8.0 silently drops a packaged
   browser's executablePath. The minimum compatible 0.10.0 forwards it. That
   dependency-floor defect and a real extracted-VSIX reproduction are now in
   browser-commander 0.8 drops packaged browser executablePath #154.

The complete validated downstream workaround is therefore the Puppeteer 25
override above, a scoped browser-commander: "0.10.0" override, and external
Playwright packages for bundled applications. The extracted 180.94 MB VSIX
successfully launched its packaged Chromium and rendered a local page with
this combination.