fix: depend on zod by range in the published packages

[alongubkin]

Fixes ALIEN-1150.

Problem

@alienplatform/core, @alienplatform/sdk, @alienplatform/ai-gateway and @alienplatform/testing depended on "zod": "4.5.2" exactly; every other runtime dependency of these packages uses a caret range. An app on any other zod 4.x got a second zod installed just for the Alien packages, and schemas and types from one copy don't match the other. An app on zod ^4.6.5 failed its type check and needed a pnpm override ("@alienplatform/core>zod": "4.6.5") to install at all cleanly.

Fix

"zod": "^4.5.2" in those four packages' dependencies, so the app's zod 4.x satisfies them. The lockfile changes only those four specifiers; resolved versions are unchanged. bindings and commands keep their exact zod devDependency, which doesn't reach apps.

Testing

• pnpm install --frozen-lockfile passes.
• Packed @alienplatform/core and installed it into a scratch app that depends on zod 4.6.5: exactly one zod (4.6.5) is installed, shared by the app and core. With the exact pin, npm nests a separate 4.5.2 under core.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[High risk] Changes dependency version constraints across published packages.

The PR appears safe to merge.

Summary

The PR changes Zod from an exact dependency to ^4.5.2 in four published packages and updates their lockfile specifiers without changing resolved versions.

• No new issue was identified in the PR changes.

_{Reviews (2) · Last reviewed commit: "Merge branch 'main' into alon/alien-1150..."}

[alongubkin]

@greptileai review