fix: bump zod to ^4.0.0 to satisfy claude-agent-sdk peer dependency

[jithin23-kv]

Problem

Installing @keyvaluesystems/agent-opfor-cli produced npm peer dependency warnings because @anthropic-ai/claude-agent-sdk@0.3.195 requires zod@^4.0.0 but the project declared zod@^3.0.0.

Solution

Upgrade zod to ^4.0.0 across all packages that declare it, and fix the two z.record() call sites that now require explicit key and value types in zod v4.

Changes

• package.json, core/package.json, runners/cli/package.json, runners/mcp/package.json — zod ^3.x → ^4.0.0
• core/src/evaluators/schema.ts — z.record(z.unknown()) → z.record(z.string(), z.unknown())
• runners/mcp/src/index.ts — z.record(z.string()) → z.record(z.string(), z.string())
• package-lock.json — updated lockfile

Issue

N/A

How to test

npm install && npm run build
cd runners/cli && npm pack
mkdir /tmp/opfor-test && cd /tmp/opfor-test
npm init -y
npm install /path/to/keyvaluesystems-agent-opfor-cli-*.tgz 2>&1 | grep -i warn
# expect: no output


<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

* **Bug Fixes**
  * Tightened frontmatter validation so `source_scan` now requires string keys (values remain flexible) when present.
  * Improved MCP environment validation by enforcing string-to-string records for the `mcp_env` input.
* **Chores**
  * Upgraded the schema/validation library to the next major version across the workspace to align behavior and improve consistency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5b432da4-6b50-4388-affd-c42b3b08c402

📥 Commits

Reviewing files that changed from the base of the PR and between eb3ec2e and 92abe5a.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

• core/package.json
• core/src/evaluators/schema.ts
• package.json
• runners/cli/package.json
• runners/mcp/package.json
• runners/mcp/src/index.ts

🚧 Files skipped from review as they are similar to previous changes (5)

• runners/cli/package.json
• runners/mcp/package.json
• runners/mcp/src/index.ts
• package.json
• core/package.json

---

Walkthrough

Upgrades zod to v4 in the root and package manifests, and updates two Zod record schemas to use explicit string-keyed validation.

Changes

Zod v4 Upgrade

Layer / File(s)	Summary
Package version bumps package.json, core/package.json, runners/cli/package.json, runners/mcp/package.json	zod dependency entries are bumped to ^4.0.0.
Schema updates for explicit z.record signature core/src/evaluators/schema.ts, runners/mcp/src/index.ts	source_scan and mcp_env switch to z.record(z.string(), valueType) form.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: achuvyas-kv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: upgrading Zod to v4 to fix the claude-agent-sdk peer dependency issue.
Description check	✅ Passed	The description includes the required Problem, Solution, Changes, Issue, and How to test sections; Screenshots is optional and not needed here.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}