[atldays]

This removes the framework's Zod security advisory and the six high audit findings inherited through release tooling.

• Migrate validation to Zod 4.6.7, preserving accepted settings, optional fields, defaults and Sandbox timeout values. Add parser and HTML callback regressions.
• Override get-uri's basic-ftp dependency to 6.2.3 without changing other dependency versions.
• Run regular CI, coverage and publication on Node 24; retain Linux/Windows × Node 22/24 for PRs to main and pre-release validation. Node 22 remains supported.

Standard Zod error wording may change; validation remains enforced and framework field context and hints are preserved.

Validation:

• npm run check passed on Node 22 and 24: 217 suites / 2523 tests on each version.
• Installed tarball consumers passed builds and strict declaration checks on both versions.
• FTP/PAC/HTTP/HTTPS checks and read-only release previews passed on both versions.
• Repository audit: 0 high, one existing low esbuild finding; production dependencies: 0 findings.
• Develop CI: all 12 jobs passed, including Linux/Windows Node 24, Chrome, Firefox and coverage.
• Full PR CI: all 22 jobs passed across Linux/Windows Node 22/24, Chrome/Firefox and coverage. Main PR source policy also passed.