chore: bump pi-agent-core/pi-ai to 0.73.1 and refresh model docs/deps

[stealthwhizz]

Fixes #98

Summary

• Bumps @mariozechner/pi-agent-core and @mariozechner/pi-ai from ^0.70.2 to ^0.73.1 — unblocks newer model IDs already present in the pi-ai registry.
• Bumps the safe minor/patch set: @modelcontextprotocol/sdk, @opentelemetry/* (excluding instrumentation-undici), @sinclair/typebox.
• Refreshes stale model references in README.md / Documentation.md / examples to models confirmed present in the 0.73.1 registry: claude-sonnet-4-6, claude-haiku-4-5, gpt-4.1-mini, gemini-2.5-flash.

Deliberately held back (see issue #98 for rationale)

• node-cron 4.x and @opentelemetry/instrumentation-undici 0.31.0 — majors/multi-minor jumps needing an API check.
• typescript 7.x and @types/node 26.x — majors needing a deliberate migration.
• The @mariozechner → @earendil-works package rename (pi-agent-core/pi-ai now deprecated in favor of the new scope, currently at 0.82.1) — separate migration touching ~31 call sites in src/, out of scope here.

Test plan

• npm install — resolves cleanly
• npm run build — tsc passes with no errors
• npm test — 65/65 tests pass

[shreyas-lyzr]

Reviewed the full diff. This is a clean dependency maintenance PR — well-scoped, clearly documented, and all green on every check I ran.

What was reviewed:

• package.json version bumps (pi-agent-core/pi-ai 0.70.x → 0.73.1, MCP SDK 1.29 → 1.30, full OTel suite 0.215/2.7 → 0.221/2.10, typebox, smithy, aws-sdk, hono, etc.)
• package-lock.json lockfile consistency — resolved URLs all point to registry.npmjs.org with matching integrity hashes
• README.md and Documentation.md model reference refreshes
• examples/local-repo.ts and examples/sdk-demo.ts

Security pass: No CVEs on any bumped package (queried OSV.dev for all 12 key packages). No secrets or hardcoded credentials. No injection surface changes — this touches only dependency versions and documentation. The @hono/node-server major bump (1.x → 2.x) is explicitly allowed by the MCP SDK 1.30.0 peer dep spec (^1.19.9 || ^2.0.5); the node engine floor bump (>=18 → >=20) is consistent with this repo's own engines: { node: '>=20' }.

One pre-existing doc nit (not introduced by this PR): README.md line 769 still references anthropic:claude-4-6-sonnet-latest (a stale alias that was already on main before this PR). Worth a follow-up cleanup but not a blocker.

The deliberately held-back items (node-cron 4.x, TypeScript 7.x, the @earendil-works package rename) are well-reasoned and tracked in issue #98.

[shreyas-lyzr]

Re-reviewed in full. Everything checks out.

Changes are confined to package.json (dep version bumps), package-lock.json (lockfile refresh), and docs/examples (model string updates). No src/ changes.

Key findings:

• All 18 newly resolved packages checked against OSV.dev: zero CVEs.
• The @hono/node-server 1.x → 2.x jump is handled correctly — MCP SDK 1.30.0 explicitly widens its peer range to ^1.19.9 || ^2.0.5, so no conflict.
• @opentelemetry/instrumentation-undici@0.25.0 nests its own instrumentation@0.215.0 alongside the top-level 0.221.0. This is expected npm deduplication behavior and does not cause a conflict at runtime.
• @mistralai/mistralai@2.5.0 adds an optional @opentelemetry/api peer dep — it's optional and the existing api@1.9.1 satisfies it.
• No hard-coded secrets, no injection surface changes, no frontend key exposure.
• Stale model IDs in src/, agents/, and docs/ (e.g. gpt-4o-mini, claude-sonnet-4-5-20250929) are pre-existing on main and not introduced or worsened by this PR. Out of scope here as noted in the PR description.

Clean dep bump. Safe to merge.