Bump axios to 1.20.0 and declare it as a direct dependency

[rcooney-sh]

Security hygiene (vulnagent campaign 2026-09, group hg_6196b8ec89ec8f04). Bumps axios from 1.7.9 to 1.20.0, which fixes AIKIDO-2026-10823 (first fixed in 1.16.1) and the other 2025/2026 axios advisories listed in triage.

axios was only present as a peer dependency of axios-retry even though src/reporter.ts imports it directly, so it is now declared explicitly:

"axios": "^1.20.0",
"axios-retry": "^4.5.0",

package-lock.json was regenerated with npm install --package-lock-only; only axios and its transitive closure changed (follow-redirects 1.16.0, form-data 4.0.6, and axios's proxy-agent helpers).

Before this leaves draft

• Rebuild dist/. dist/index.js still bundles axios 1.7.9. It could not be regenerated by the agent because @buf/blacksmith_vm-agent.connectrpc_es lives on the private buf registry (needs BUF_TOKEN). A maintainer must run npm ci && npm run build on this branch and commit dist/. Until then the verify-build check fails by design.

How to review: package.json adds one line; the lockfile diff is mechanical. After the dist rebuild, grep -o 'const Ie="1\.[0-9.]*"' dist/index.js (the bundled axios version constant) should read 1.20.0.

Risk level: medium
Breaking-change risk: axios 1.x keeps API compatibility; reporter.ts uses axios.create, interceptors and AxiosError, and axios-retry's peer range (0.x || 1.x) still matches. Medium only because the shipped action bundle changes and CI (Node 16 in build/verify-build) must rebuild it; if Node 16 rejects any new transitive syntax, bump the workflows' Node version first.
Validation: lockfile diff reviewed; no local build or tests (private registry). PR CI: build.yml runs npm ci, build and jest; verify-build.yml gates on the committed dist matching a fresh build.
Rollback: revert the commit(s) (package.json, package-lock.json, dist/). Consumers pinned to existing tags are unaffected until tags move.

Covered problems: prb_8c3e527b6c664882
Aikido findings: https://app.aikido.dev/issues/single/461280833
Linear: https://linear.app/blacksmith-sh/issue/SEC-690/medium-aikido-2026-10823

Note: the same problem also covers useblacksmith/setup-docker-builder (pnpm-lock axios 1.15.0, findings 461281113 and 461281157). That repo is not part of this group and needs a scoped follow-up.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled. (Staging)}

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

[linear-code]

SEC-690