fix(tests): resolve 4 failing test suites and patch lodash vulnerability

Test fixes (type mismatches introduced by V&V resolution changes):
- HealthDetailedController.test.ts: replace pool/makePool with dbProbe/makeDbProbe
  to match refactored HealthDetailedDeps interface (Pool → DbProbe abstraction)
- EventPublisher.test.ts: pass all 4 required constructor args to WebhookDeliveryWorker
  mock (pool, vaultClient, redisClient, redisUrl) — was passing only 1
- MarketplaceService.test.ts: IAgent.did/didCreatedAt are string|undefined (not null);
  fix makeAgent defaults and makeAgent({did:null}) call; fix type assertion to unknown first
- OIDCTrustPolicyService.test.ts: ICreateTrustPolicyRequest.branch is string|undefined
  (not nullable); replace all branch:null with branch:undefined

Security fix:
- npm audit fix: lodash ≤4.17.23 (HIGH) → patched; 0 vulnerabilities remaining

Result: 50/50 test suites pass, 722/722 tests pass, 0 vulnerabilities

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/services/EventPublisher.test.ts

@@ -19,7 +19,13 @@ function makePool(queryImpl?: jest.Mock): jest.Mocked<Pool> {
 }
 
 function makeWorker(): jest.Mocked<WebhookDeliveryWorker> {
-  const worker = new MockWorker({} as never) as jest.Mocked<WebhookDeliveryWorker>;
+  // WebhookDeliveryWorker(pool, vaultClient, redisClient, redisUrl) — pass all required args
+  const worker = new MockWorker(
+    {} as never,
+    null,
+    {} as never,
+    'redis://localhost',
+  ) as jest.Mocked<WebhookDeliveryWorker>;
   worker.enqueue = jest.fn().mockResolvedValue(undefined);
   return worker;
 }

tests/unit/services/MarketplaceService.test.ts

@@ -27,8 +27,8 @@ function makeAgent(overrides: Partial<IAgent> = {}): IAgent {
     isPublic: true,
     createdAt: new Date('2026-01-01'),
     updatedAt: new Date('2026-01-02'),
-    did: null,
-    didCreatedAt: null,
+    did: undefined,
+    didCreatedAt: undefined,
     ...overrides,
   };
 }
@@ -62,7 +62,7 @@ describe('MarketplaceService', () => {
       agentRepo.findPublicAgents = jest.fn().mockResolvedValue({ agents: [agent], total: 1 });
 
       const result = await service.listPublicAgents(BASE_FILTERS);
-      const card = result.data[0] as Record<string, unknown>;
+      const card = result.data[0] as unknown as Record<string, unknown>;
 
       expect(card['email']).toBeUndefined();
       expect(card['organizationId']).toBeUndefined();
@@ -79,7 +79,7 @@ describe('MarketplaceService', () => {
     });
 
     it('should return null DID document when agent has no DID', async () => {
-      const agent = makeAgent({ did: null });
+      const agent = makeAgent({ did: undefined });
       agentRepo.findPublicAgents = jest.fn().mockResolvedValue({ agents: [agent], total: 1 });
 
       const result = await service.listPublicAgents(BASE_FILTERS);

tests/unit/services/OIDCTrustPolicyService.test.ts

@@ -52,7 +52,7 @@ describe('OIDCTrustPolicyService', () => {
       const result = await service.createTrustPolicy({
         provider: 'github',
         repository: 'acme/my-repo',
-        branch: null,
+        branch: undefined,
         agentId: 'agent-001',
       });
 
@@ -66,7 +66,7 @@ describe('OIDCTrustPolicyService', () => {
         service.createTrustPolicy({
           provider: 'gitlab' as never,
           repository: 'acme/my-repo',
-          branch: null,
+          branch: undefined,
           agentId: 'agent-001',
         }),
       ).rejects.toThrow(ValidationError);
@@ -77,7 +77,7 @@ describe('OIDCTrustPolicyService', () => {
         service.createTrustPolicy({
           provider: 'github',
           repository: 'no-slash-here',
-          branch: null,
+          branch: undefined,
           agentId: 'agent-001',
         }),
       ).rejects.toThrow(ValidationError);
@@ -88,7 +88,7 @@ describe('OIDCTrustPolicyService', () => {
         service.createTrustPolicy({
           provider: 'github',
           repository: 'acme/my-repo',
-          branch: null,
+          branch: undefined,
           agentId: '',
         }),
       ).rejects.toThrow(ValidationError);
@@ -101,7 +101,7 @@ describe('OIDCTrustPolicyService', () => {
         service.createTrustPolicy({
           provider: 'github',
           repository: 'acme/my-repo',
-          branch: null,
+          branch: undefined,
           agentId: 'nonexistent',
         }),
       ).rejects.toThrow(ValidationError);