[jmgasper]

Patches the Procurement API runtime and tooling dependencies, retains Prisma 6 at its patched release, and pins the shared Topcoder library immutably. Updates pnpm/workspace configuration and Node 26.12.1 / Alpine image pins; preserves the minimal runtime and UID 10001. Docker now verifies lint and tests before producing the runtime. Older tooling uses a tested minimatch adapter; the only source change is formatter output for a health-result type.

Validation:

• Full audit: zero critical/high/medium findings, one low. Original target Dependabot alerts: 46 patched/removed, one withdrawn advisory, none unresolved.
• Prisma generation, lint, production build, all 51 existing tests and two matcher tests pass, including in Docker.
• Final production image: zero critical/high/medium Trivy findings.
• Both repository migrations pass against isolated PostgreSQL. Final image passes readiness, authenticated vendor create/read/update/delete, missing/expired token rejection (401), and non-procurement-role rejection (403). Node 26.12.1 / UID 10001 verified.

No merge, deployment or shared database operation was performed.