chore(infra): sync image locks to SDK 2.8.8

[github-actions]

Scope

Advance the seven first-party Linux/amd64 infrastructure images and the UHRP Cloud Bucket notifier to the now-published @bsv/sdk@2.8.8. This is the image-source follow-up to the security patch in #636 and protected npm release 36203445642 (attempt 2, successful).

The protected SDK artifact was published from merged main 6f3427e5b086fbb681c2160e78e7980f2a96dd5f; the public npm tarball has the same SHA-256 and SHA-512 integrity as the immutable release candidate, with provenance attestation. This PR changes only infrastructure package manifests and standalone locks plus generated stack facts. No SDK code, public API, wire format, wallet data, workflow permissions, release gate, or deployment config changes here.

Dependency review

• Regenerated all eight standalone npm locks with governed Node 24/npm 11 and lockfile-only installation. Each lock contains exactly one @bsv/sdk copy at 2.8.8, with the published tarball integrity.
• ChainTracks previously resolved SDK 2.8.5 only through @bsv/wallet-toolbox's peer dependency. Added an explicit @bsv/sdk: ^2.8.8 runtime dependency so its image and future generated version syncs advance with the SDK.
• First-party dependency floors were advanced to the already published versions emitted by pnpm sync-versions; no unrelated third-party version or override changes. pnpm sync-versions --dry-run has no remaining changes.
• Each standalone npm lock audit reported zero vulnerabilities. git diff --check passed.

Hosted and release gates

• Exact-head CI 36205144653, CodeQL 36205144768, container runtime contracts 36205144705, Sonar zero-new-findings, affected infra build/test, dependency review, and merge gate all passed on 1f42db5aee20c67f0188302a880d94980fc2ef17. I self-reviewed the complete diff, including lock resolution and release impact; there are no open review threads.
• Once those gates pass, the operator has authorized maintainer administrative merge without waiting for another review. No quality or security gate will be disabled or bypassed.
• After merge, the protected infrastructure release will build all seven Linux/amd64 images in CI, scan for high/critical findings, and publish immutable GHCR digests with SBOM, provenance, and signatures. Existing immutable images remain the rollback path.
• Evans Creek services will be updated staging first, then production, with endpoint and public-route validation before advisory publication.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​bsv/​message-box-client@​2.5.3 ⏵ 2.5.4	+1		+1	+1
	npm/​@​bsv/​wallet-toolbox@​2.14.0 ⏵ 2.14.2				+1
	npm/​@​bsv/​sdk@​2.8.5 ⏵ 2.8.8	+1			+1
	npm/​@​bsv/​overlay-topics@​1.8.4 ⏵ 1.9.0	+1		+1	+1
	npm/​@​bsv/​wallet-toolbox-client@​2.14.0 ⏵ 2.14.2	+1		+1	+1

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud