chore: depend on the published envsitter 0.1.0

Refresh package-lock.json so npm ci resolves envsitter 0.1.0 from the registry (integrity matches the published tarball), which fixes CI's ETARGET failure.

AGENTS.md

@@ -51,7 +51,7 @@ Tests use Node’s built-in test runner, compiled via `tsc` into `dist-test/`.
 - Cross-version e2e (needs the CLIs installed; not part of `npm test`): `npm run test:e2e`
 - Run a single test file:
   - `npm run build:test && node --test dist-test/test/envsitter-guard.v2.test.js`
-- Until `envsitter` 0.1.0 is published, tests need a local build: `npm pack` in `../envsitter`, then `npm install --no-save <tarball>` here.
+- To test against an unreleased `envsitter`: `npm pack` in `../envsitter`, then `npm install --no-save <tarball>` here (CI always uses the published version from the lockfile).
 
 Pre-commit checks are enforced via Husky:
 - `npm install` installs the git hook.

package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "@opencode-ai/plugin": "^1.19.3",
-        "envsitter": "^0.0.4"
+        "envsitter": "^0.1.0"
       },
       "devDependencies": {
         "@opencode/plugin": "^2.1.0",
@@ -2225,12 +2225,15 @@
       }
     },
     "node_modules/envsitter": {
-      "version": "0.0.4",
-      "resolved": "https://registry.npmjs.org/envsitter/-/envsitter-0.0.4.tgz",
-      "integrity": "sha512-Uxy5XpYQ9B6+70cQrIOKQMxaitKjMDxaK1uPaivhtVbYxQMRhJzdvx+6AgSrRrZBcnuPlLbnVPXrn7PXpi+veg==",
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/envsitter/-/envsitter-0.1.0.tgz",
+      "integrity": "sha512-TTAOL+TCkU+PG+u+Y68AOrxePCuB7x0Zg9OvMFK/yo0But34tXm8EaVvDVk7QbgMOurRWEMI7zhu3md9XT2dbQ==",
       "license": "MIT",
       "bin": {
         "envsitter": "dist/cli.js"
+      },
+      "engines": {
+        "node": ">=22"
       }
     },
     "node_modules/exponential-backoff": {