chore(deps): migrate zod 3 → 4 across the workspace

[stackbilt-admin]

Dependabot has repeatedly opened the zod 3 → 4 bump (#283 zod 4.5.1, #288 zod 4.5.4, #290 zod 4.6.2) and every one has failed CI. #290 was closed with @dependabot ignore this major version so it stops reopening; this issue tracks doing the migration deliberately.

Current state

zod ^3.24.1 is declared in five places: the root package.json and packages/{blast,cli,core,surface}/package.json. They must move together — a split version pulls two copies of zod into the tree and instanceof ZodError checks stop matching across package boundaries.

12 modules import from zod. Files using API surface that zod 4 changed:

• packages/blast/src/index.ts
• packages/cli/src/commands/blast.ts
• packages/cli/src/commands/context-refresh.ts
• packages/cli/src/commands/surface.ts
• packages/cli/src/commands/serve.ts
• packages/cli/src/__tests__/context-refresh.test.ts
• packages/cli/src/__tests__/context-refresh-repo-intel.test.ts

What failed on #290

Charter Governance failed (run 35507494106). build-and-test was also red on the run captured before the rebase. Neither was investigated in depth — that is the first step here.

Why this needs real work, not a version bump

zod 4 changes error handling (.errors → .issues), z.record() arity, and the .strict()/.passthrough() model. serve.ts validates MCP tool input and context-refresh.ts validates the snapshot schema, so a silent behavior change there affects the MCP surface and the context snapshot that agents read at session start.

Scope

• Read the CI failures on a fresh zod 4 branch and enumerate the actual breaks
• Bump all five package.json files together
• Migrate error handling and schema construction in the seven files above
• Confirm pnpm test, pnpm run typecheck, and Charter Governance are green
• Re-enable the dependabot major with @dependabot unignore once landed