[redanthrax]

Consolidates the eleven open Dependabot PRs into one change. Seven of them edit HaloPsaMcp.csproj and packages.lock.json, so merging them one at a time would mean a conflict and a rebase between each.

Dependency	Change	Supersedes
WolverineFx / WolverineFx.RuntimeCompilation	6.39.1 → 6.61.0	#135
StackExchange.Redis	3.3.0 → 3.4.31	#133
ModelContextProtocol / ModelContextProtocol.AspNetCore	2.2.0 → 2.3.1	#132
Microsoft.AspNetCore.OpenApi	10.0.12 → 10.0.14	#126
Microsoft.AspNetCore.DataProtection.Extensions	10.0.12 → 10.0.14	#125
Microsoft.OpenApi	2.12.2 → 2.13.0	#119
dotnet/sdk build image	10.0.401 → 10.0.403	#123
actions/setup-dotnet	6.0.0 → 6.1.0	#131
docker/login-action	4.6.0 → 4.7.0	#124
actions/upload-artifact	7.0.1 → 7.0.2	#113
docker/setup-buildx-action	4.2.0 → 4.4.1	#104

Verification

These checks were run locally against this exact change set:

• dotnet restore --locked-mode: clean (lock file regenerated once against the combined set)
• dotnet build -c Release: 0 errors. The warnings match master exactly, code by code.
• dotnet test: 114/114 passed
• dotnet list package --vulnerable --include-transitive: no vulnerable packages
• docker build --pull: succeeds. The runtime is now ASP.NET Core / .NET 10.0.14.
• Trivy (CRITICAL,HIGH, --ignore-unfixed): 0 vulnerabilities
• Container smoke test on Wolverine 6.61: /health 200, /ready 200, /.well-known/oauth-protected-resource 200, /login 302

A release cut from this resolves #130.

Known issue, not caused by this PR

An unauthenticated POST /mcp returns 500 on the default file token-store backend. The exception is IConnectionMultiplexer is only available when HALOPSA_TOKEN_STORE_BACKEND=redis. An image built from master gives the identical 500, so this PR didn't introduce it. The cause is in TokenStoreRegistration.AddRedisConnectionIfNeeded: it always registers a factory that throws, and HaloPsaTokenRefresher resolves it through GetService. That will be tracked separately.