…nsion (#235)

The Amazon Q CLI notification is no longer needed as a post-startup popup
in SageMaker Unified Studio Code Editor.

Co-authored-by: Shilpi Parikh <[email protected]>

… CVEs

- Fix npm ci failure: regenerate package-lock-overrides to include http-proxy
- undici: ^7.24.0 → ^7.28.0 (CVE-2026-6734, CVE-2026-9697, CVE-2026-12151)
- ws: ^8.20.1 → ^8.21.0, chrome-remote-interface/ws: ^7.5.11 (CVE-2026-48779)
- form-data: ^4.0.6 (CVE-2026-12143)
- tar: ^7.5.16 (CVE-2026-53655)

Regenerated package-lock overrides for all targets.

…fications

Replace __SAGEMAKER_VERSION__ placeholder with the actual conda
package version. This value is displayed in Help > About.

….0, brace-expansion to ^5.0.8

…nsion host iframe and notebook render mitigations

Restrict Copilot debug/proxy/CAPI URL override settings to user (global)
scope only via a new common quilt patch, so a workspace's settings.json can
no longer redirect Copilot requests to an attacker endpoint. Register the
already-shipped extension host iframe parentOrigin hardening (web-server/
webview.diff) and the notebook/mermaid render safety as backported entries;
the upstream vulnerable mermaid preview file is not present and the shipped
renderer already avoids untrusted innerHTML.

Remove the copilot patch when Code-OSS is updated to >= 1.128.1.

…sion build tool to ^5.0.9

Bumps the undici and ip-address dependency override versions flagged by the nightly Security Scan and regenerates the affected package-lock overrides and OSS attribution. Also bumps brace-expansion to ^5.0.9 in the oss-attribution-generator build tool. Downstream finding-override patches (axios, ws, github-copilot, form-data, tar, anthropic-sdk, shell-quote) and quilt-managed patches later in the series are refreshed for context drift in the shared overrides block; their own override versions and code changes are unchanged.