chore: pin the dependencies that floated on latest

Five dependencies used "latest", so every upstream release changed the resolution and CI's frozen install refused the lockfile. They now use ranges around the versions already locked and deployed, so nothing changes at runtime.

apps/agent-worker/package.json

@@ -17,10 +17,10 @@
   "dependencies": {
     "@octokit/auth-app": "^8.2.0",
     "@octokit/rest": "^22.0.1",
-    "@opencode-ai/sdk": "latest",
+    "@opencode-ai/sdk": "^1.17.18",
     "convex": "catalog:convex",
     "dockerode": "^4.0.7",
-    "execa": "latest",
+    "execa": "^9.6.1",
     "ws": "catalog:",
     "zod": "catalog:"
   },