fix(ci): restore checks for transport cleanup

[dills122]

Summary

• Keep the fixed-size chunk iteration cleanup for the Rust transport layer.
• Restore the repository-wide security gate by remediating the current Node and Go standard-library advisories.
• Synchronize the standalone marketing-site lockfile exposed by the full CI path.

What Changed

• Replace manual two-byte chunk handling with fixed-size slice chunks in transport decoding paths.
• Update the root lockfile to undici 7.29.0 and fast-uri 3.1.5.
• Pin WML build and security jobs to Go 1.26.6, which contains the required standard-library fixes.
• Update the pinned WML server builder image to the immutable Go 1.26.6 Alpine digest.
• Regenerate marketing-site/pnpm-lock.yaml for the declared Astro 7.1.6 dependency.

Validation

• make lint-rust-transport
• make test-rust-transport
• pnpm install --frozen-lockfile --ignore-scripts
• pnpm audit --audit-level high
• pnpm --dir marketing-site --ignore-workspace install --frozen-lockfile --ignore-scripts
• pnpm --dir marketing-site --ignore-workspace run build
• GOTOOLCHAIN=go1.26.6 go test ./... in wml-server/
• docker build --tag wap-labs/wml-origin:security wml-server
• grype wap-labs/wml-origin:security --fail-on high with CI-pinned Grype 0.112.0
• network-preview deployment contract tests and formatting checks
• pnpm verify:fast
• repository pre-push checks

Scope Notes

• The security audit runs unconditionally for pull requests, so its baseline fixes must be present in this lower stack branch for fix(ci): restore checks for transport cleanup #562 to pass independently.
• No transport contracts or generated browser contracts changed.
• test(ci): guard standalone marketing lockfile #563 remains stacked on this branch and adds a local regression guard for standalone lockfile drift.