[bartsdev]

Summary

Replaces #91, rebased onto main. This is a lockfile-only bump of a transitive dependency.

 proxy-addr@^2.0.7:
-  version "2.0.7"
+  version "2.0.8"

Evidence

• Before (Bump proxy-addr from 2.0.7 to 2.0.8 #91): build and smoke passed. mcp-direct-tests failed with Missing required environment variable: LOCALSTACK_AUTH_TOKEN, because runs triggered by Dependabot can't read repo secrets.
• After: this branch was pushed by a maintainer, so CI runs with the repo's LOCALSTACK_AUTH_TOKEN. yarn install --frozen-lockfile passes locally.

Merge Danger

Door: two-way

Blast Radius: minimal

This changes only a lockfile entry for a transitive dependency.

🤖 Generated with Claude Code