fix(tests): resolve 4 failing test suites and patch lodash vulnerability

Test fixes (type mismatches introduced by V&V resolution changes):
- HealthDetailedController.test.ts: replace pool/makePool with dbProbe/makeDbProbe
  to match refactored HealthDetailedDeps interface (Pool → DbProbe abstraction)
- EventPublisher.test.ts: pass all 4 required constructor args to WebhookDeliveryWorker
  mock (pool, vaultClient, redisClient, redisUrl) — was passing only 1
- MarketplaceService.test.ts: IAgent.did/didCreatedAt are string|undefined (not null);
  fix makeAgent defaults and makeAgent({did:null}) call; fix type assertion to unknown first
- OIDCTrustPolicyService.test.ts: ICreateTrustPolicyRequest.branch is string|undefined
  (not nullable); replace all branch:null with branch:undefined

Security fix:
- npm audit fix: lodash ≤4.17.23 (HIGH) → patched; 0 vulnerabilities remaining

Result: 50/50 test suites pass, 722/722 tests pass, 0 vulnerabilities

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/services/EventPublisher.test.ts

@@ -19,7 +19,13 @@ function makePool(queryImpl?: jest.Mock): jest.Mocked<Pool> {
 }
 
 function makeWorker(): jest.Mocked<WebhookDeliveryWorker> {
-  const worker = new MockWorker({} as never) as jest.Mocked<WebhookDeliveryWorker>;
+  // WebhookDeliveryWorker(pool, vaultClient, redisClient, redisUrl) — pass all required args
+  const worker = new MockWorker(
+    {} as never,
+    null,
+    {} as never,
+    'redis://localhost',
+  ) as jest.Mocked<WebhookDeliveryWorker>;
   worker.enqueue = jest.fn().mockResolvedValue(undefined);
   return worker;
 }