fix: pin transitive hono dependency to >=4.13.5 (moderate advisory)

A moderate-severity advisory chain (GHSA-gqvv-2mrq-wpjv,
GHSA-g6gw-c38x-mqfc, GHSA-crvj-82cr-hjcx) was newly published against
hono <4.13.5, pulled in transitively via @anthropic-ai/claude-agent-sdk
-> @modelcontextprotocol/sdk. Discovered blocking
tests/npm-integrity-gate.test.cjs while verifying #4513 (unrelated to
that batch's diff); fixed inline per this repo's no-defer policy.

Adds "hono": ">=4.13.5" to package.json's existing overrides block
(same pattern already used for qs, body-parser, @hono/node-server).
npm audit --omit=dev now reports 0 vulnerabilities.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

package.json

@@ -85,7 +85,8 @@
   "overrides": {
     "qs": ">=6.15.2",
     "body-parser": ">=2.3.0",
-    "@hono/node-server": ">=2.0.5"
+    "@hono/node-server": ">=2.0.5",
+    "hono": ">=4.13.5"
   },
   "optionalDependencies": {
     "fallow": "^2.70.0"