Run npm audit fix and adapt the gulp build for v5

[Copilot]

This removes the remaining npm audit findings by taking the required gulp/gulp-cli upgrades and preserving the existing build flow under the new task runtime. The only code change is in the static asset copy task, which now completes explicitly instead of relying on gulp 4 stream behavior.

• Dependency updates

  • upgrade gulp from 4.x to 5.x
  • upgrade gulp-cli from 2.x to 3.x
  • refresh package-lock.json to capture the audited dependency graph
  • drop merge2, which is no longer needed after the task rewrite

• Build compatibility

  • rewrite compile:static to await both copy pipelines explicitly
  • preserve the existing outputs:
    • repository assets copied into dist/
    • @c4312/chromehash wasm relocated into dist/src/

• Behavioral impact

  • no product/runtime logic changes
  • build pipeline stays functionally equivalent while avoiding the gulp 5 task completion regression

gulp.task('compile:static', async () =>
  Promise.all([
    finishedAsync(gulp.src([...], { base: '.' }).pipe(gulp.dest(buildDir))),
    finishedAsync(
      gulp.src(['node_modules/@c4312/chromehash/pkg/*.wasm'])
        .pipe(rename({ dirname: 'src' }))
        .pipe(gulp.dest(buildDir)),
    ),
  ]));