chore(deps): patch toml and esbuild in the opencode plugin lockfiles

Two Dependabot alerts on the opencode plugin workspaces, both dev-scope:

- #209 (high) toml@4.1.1 — prototype pollution via `__proto__` key-path
  desynchronization (GHSA-v5mp-jgw5-2x6j), pulled transitively by `effect`
  under `@opencode-ai/plugin`. Patched in 4.1.2.
- #210 (low) esbuild@0.27.7 — arbitrary file read from the dev server on
  Windows (GHSA-g7r4-m6w7-qqqr), nested under `tsup`. Patched in 0.28.1.
  The top-level esbuild was already 0.28.1; only the nested copy lagged.

Both are resolved with an `overrides` entry, reusing the pattern the v1
plugin already applies to esbuild. Neither package reaches the published
runtime — they are build-time only — so this is hygiene, not an exposure fix.

toml 4.1.1 -> 4.3.0, nested esbuild 0.27.7 dropped (single 0.28.2 remains).
`npm install` reports 0 vulnerabilities in both workspaces; both plugins
build and their suites pass (367 and 218 tests).

@omniroute/opencode-plugin/package-lock.json

@@ -1745,9 +1745,9 @@
       }
     },
     "node_modules/toml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/toml/-/toml-4.1.1.tgz",
-      "integrity": "sha512-EBJnVBr3dTXdA89WVFoAIPUqkBjxPMwRqsfuo1r240tKFHXv3zgca4+NJib/h6TyvGF7vOawz0jGuryJCdNHrw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-4.3.0.tgz",
+      "integrity": "sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A==",
       "dev": true,
       "license": "MIT",
       "engines": {

@omniroute/opencode-plugin/package.json

@@ -68,6 +68,7 @@
     "typescript": "^5.9.3"
   },
   "overrides": {
-    "esbuild": "^0.28.1"
+    "esbuild": "^0.28.1",
+    "toml": "^4.1.2"
   }
 }