[harmony7]

Closes #96.

All 16 JavaScript and TypeScript kits change @fastly/js-compute from ^3.46.0 to
^4.0.1. Dependabot does not propose major version changes, thus this change is manual.

Command: node tools/bump-deps.mts @fastly/js-compute 4.0.1 javascript

After this PR, no kit has the decompress advisory. No kit has more than one copy of
the SDK.

Commits

Commit	Change
02d5ceb	Change js-compute to ^4.0.1 in 16 kits
2564e80	Update the jco transitive, which removes decompress
5793802	Change typescript-hono to @fastly/hono-fastly-compute 0.4.0
1dc8e62	Repair the openapi-validation build
b4221e1	Change expressly to @fastly/expressly 2.5.0

The js-compute change alone does not remove decompress

js-compute 4.0.1 requires weval ^0.5.1, which does not use decompress. But it also
requires jco ^1.17.9, and npm kept the jco 1.25.2 from each lockfile. jco 1.25.2
requires componentize-js ^0.21.0, which requires weval ^0.4.1. That weval uses
decompress.

npm update @bytecodealliance/jco changes jco to 1.38.0 and componentize-js to 0.23.0.
componentize-js 0.23.0 requires weval ^0.5.0. jco is a transitive dependency, thus
only the lockfiles change. This removes decompress from 14 kits.

Two kits had a different cause. Their wrapper packages had @fastly/js-compute in
dependencies, thus npm installed a second, nested copy of js-compute 3.46.0. That
copy contains the old weval. Both wrappers now have a release that makes js-compute a
peer dependency:

Kit	Wrapper	Accepts
typescript-hono	@fastly/hono-fastly-compute 0.4.0	^3.33.0 || ^4.0.0
expressly	@fastly/expressly 2.5.0	^3.33.2 || ^4.0.0

The openapi-validation kit does not build on main

This bump is not the cause. Both failures also occur on main with js-compute 3.46.0.

1. process/browser has no file extension, thus webpack cannot resolve it from a fully
   specified importer. The kit depends on @apidevtools/json-schema-ref-parser, which
   is an ESM package, and ESM modules are fully specified. An explicit extension
   resolves in both types of importer.
2. output.publicPath has no value, thus webpack writes a runtime that looks for
   document or location. The Compute runtime has neither, and the build stopped at
   Wizer with the message "Automatic publicPath is not supported in this browser". The
   kit serves no assets, thus an empty string is correct.

Commit 1dc8e62 makes these two changes. Without it, this PR cannot pass CI. It also
unblocks PR #103, which has a High severity fix for openapi-backend and fails on the
same kit. Tell me if you prefer a separate PR for this commit.

Tests

I built all 16 kits with Fastly CLI v16.1.0. All 16 kits pass.

I also ran the expressly kit with Viceroy, because a third-party library in this kit
moves to js-compute 4.x. The middleware header, GET /, POST /submit and the 404
response are all correct.

🤖 Generated with Claude Code