chore(deps): upgrade native napi build and derive dependencies

[dependabot]

Summary

Upgrade the native bindings' napi-build dependency from 2.4.1 to 2.5.0 and napi-derive from 3.6.3 to 3.6.9, with compatible macro dependencies and complete license packaging.

Changes

• Update both pinned dependencies and the Cargo lockfile, including convert_case 0.12.0.
• Lock napi-derive-backend to 6.1.4 so it uses the same syn major version as napi-derive 3.6.9. Version 6.1.5 caused compiler type mismatches between syn 2 and 3.
• Refresh the version-specific license entries for the upgraded NAPI crates after verifying their upstream licenses. This fixes native and standalone plugin license packaging.

Testing

• Ruff 0.16.9 check and format checks passed for plugins/codex-security.
• pnpm --dir sdk/typescript run build:ci passed.
• Plugin source compatibility check and all 9 compatibility tests passed.
• cargo fmt --check and cargo clippy --locked -- -D warnings passed.
• Native release build, license notice generation, and the Linux x64 Node-API 8 behavioral proof passed on Node 24.21.0, including with an empty PATH.
• Verified the upgraded crates' upstream license text matches the vendored license byte for byte.

Risk and rollout

No public CLI or runtime settings change. The lockfile preserves the compatible macro/backend pairing, and license overrides remain restricted to reviewed package versions. Supersedes #1301 by including its complete dependency update and fixes. Merge after the cross-platform native and package CI checks pass; close #1301 after this combined update lands.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

Merge validation

Local validation and reviews passed. Administrator merge is used while GitHub Actions is degraded; hosted checks have not completed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-05T19:36:38.228730Z	43da2e6	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed both native dependency upgrades together, including the compatible derive/backend lock and all version-specific license updates. The combined branch passes locked native compilation, linting, notice generation, behavioral proofs, and portable source checks. Both reviewed changes have clean independent review and verification results. No blocking findings at 43da2e6; merge after required CI passes.