chore(deps): safe updates — marked patch, webpack/ts-loader minors, VS Code types in lockfile

[gaord]

Summary

• marked 18.0.4 → 18.0.13 (patch) — the only dependency in this set that actually ships inside the VSIX (bundled by webpack for webview rendering)
• webpack 5.107 → 5.111, ts-loader 9.5 → 9.6 (minors) — build-time only, not shipped
• @types/vscode: lockfile resolves to 1.138.0 while the manifest keeps declaring ^1.85.0, because vsce rejects a declared types range above engines.vscode — engines stays ^1.85.0, so no user is asked to upgrade their editor

This is the safe subset of #17, split out per the stable-upgrade policy: patches and minors flow; majors are deferred to the toolchain roadmap.

Verification

• npm run lint ✓
• npm test — 1174 tests ✓
• npm run package (webpack production) ✓
• npx @vscode/vsce package --no-dependencies ✓ (VSIX builds, 11 files)

Checklist

• npm run lint passes
• npm test passes
• CHANGELOG.md entry — not user-visible (no behavior change; marked patch only)
• Agent behavior stays in the engine