evals/promptfoo: bump hono and @hono/node-server to clear 6 dependabot alerts

Summary

GitHub Dependabot is reporting 6 open medium-severity alerts against evals/promptfoo/package-lock.json. All of them are transitive dependencies pulled in by promptfoo@0.121.3, and all resolve to two underlying packages:

• hono 4.12.11 → needs >= 4.12.12
• @hono/node-server 1.19.12 → needs >= 1.19.13

Affected alerts

#	Package	Severity	GHSA	Summary
7	hono	medium	GHSA-r5rp-j6wh-rvv4	Non-breaking space prefix bypass in cookie name handling in getCookie()
6	hono	medium	GHSA-xpcf-pg52-r92g	Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
5	hono	medium	GHSA-26pp-8wgv-hjvm	Missing validation of cookie name on write path in setCookie()
4	hono	medium	GHSA-xf4j-xp2r-rqqx	Path traversal in toSSG() allows writing files outside output dir
3	hono	medium	GHSA-wmmm-f939-6g9c	Middleware bypass via repeated slashes in serveStatic
2	@hono/node-server	medium	GHSA-92pp-h63x-v22m	Middleware bypass via repeated slashes in serveStatic

All 6 alerts are confined to the promptfoo eval harness — no production swamp code or CLI surface is affected. The risk is low (we only run promptfoo locally/in CI for evals, not as an internet-facing service), but the alerts create noise in the security tab.

Proposed fix

This affects only evals/promptfoo/package.json and its lockfile. The fix would involve one of the following, in order of preference:

1. Bump promptfoo to a newer release that already pulls in patched hono >= 4.12.12 and @hono/node-server >= 1.19.13 transitively. Verify the new version is API-compatible with how we call promptfoo from the eval harness.
2. If no upstream promptfoo release pins the patched versions yet, add npm overrides for hono and @hono/node-server to evals/promptfoo/package.json (alongside the existing @anthropic-ai/sdk override) and regenerate the lockfile.
3. Re-run the promptfoo eval suite once to confirm nothing regressed.

Verification

• evals/promptfoo/package-lock.json should resolve hono to >= 4.12.12 and @hono/node-server to >= 1.19.13.
• All 6 dependabot alerts (#2 through #7) should auto-close after the bump merges.
• The promptfoo eval harness should still run end-to-end against a sample config.

Environment

• Repo: systeminit/swamp
• File: evals/promptfoo/package-lock.json
• Today's promptfoo version: 0.121.3