feat: consolidate dependency updates

[venkatamutyala]

Consolidates the open Renovate dependency PRs into one branch, validated end-to-end in Docker. Highest version wins where multiple PRs touched the same item.

Included — GitHub Actions (SHA-pinned)

Action	File	Version	Supersedes
actions/checkout	image.yml	v6 (df4cb1c)	#454
docker/setup-qemu-action	image.yml	v4 (0611638)	#467
docker/setup-buildx-action	image.yml	v4.1.0	#474
docker/login-action	image.yml	v4.2.0	#472, #461
docker/metadata-action	image.yml	v6.1.0	#473
docker/build-push-action	image.yml	v7.2.0	#471, #464
dataaxiom/ghcr-cleanup-action	cleanup_images.yaml	v1.2.1	#470, #469

Included — Docker base image

• Dockerfile: node:24-alpine digest → sha256:a0b9bf0… (chore(fallback): update node #455)

Included — npm dependencies (package-lock.json regenerated from scratch → newest-in-range)

• axios → 1.18.1 (supersedes chore(lockfile): update axios-lockfile #patch #468 1.16.1, chore(lockfile): update axios-lockfile #patch #463 1.15.2)
• @slack/bolt → 4.7.3 (chore(lockfile): update @slack/bolt-lockfile #patch #462)
• dotenv → 17.4.2 (chore(lockfile): update dotenv-lockfile #patch #460)
• plus full lock-file maintenance of transitive deps, incl. express 5.2.1, winston 3.19.0, @slack/* (chore: lock file maintenance #457)

Validation (all in Docker — host has no Node toolchain)

• docker build . (repo Dockerfile, new node digest, npm ci --only=production) — green, 0 vulnerabilities
• node --check app.js / app-server.js — syntax OK
• ESM import smoke of all upgraded deps (@slack/bolt, express, axios, winston, dotenv, slack-block-builder, unique-names-generator) — all OK

Excluded (left open)

• chore(fallback): update glueops/github-workflows - autoclosed #475 (GlueOps/github-workflows in bump_version.yaml) — bump_version.yaml is being removed by the release-please migration (ci: add release-please #477). Editing it would conflict. If ci: add release-please #477 is not merged, chore(fallback): update glueops/github-workflows - autoclosed #475 can be merged independently.
• refactor: replace base64url with hex encoding in token generation #400 — Copilot draft refactor, not a dependency update.

Not merging — left for review. Superseded bot PRs will be closed with a pointer here.