chore(deps): drop unused direct dependency lodash

[DeepDiver1975]

What

Removes the lodash direct dependency and its stray import in ext-antora/generate-index.js.

Why

lodash is declared as a direct dependency and imported at ext-antora/generate-index.js:5 (const _ = require('lodash')), but it is never used. There is no _. call anywhere in that file or the rest of the repo — the only _ occurrences are in comments (e.g. a // Q: use _.difference(...) note) and string literals (_index, _email-config.adoc).

This is a follow-up to #182 (dropping the unused asciidoctor dep). A full re-audit of the remaining dependencies — confirmed independently by a second pass — found lodash as the only other removable one; all 7 others (@elastic/elasticsearch, antora, asciidoctor-kroki, cheerio, html-entities, js-yaml, plus dev deps broken-link-checker, http-server) are genuinely used.

Changes

• ext-antora/generate-index.js — remove the unused require('lodash') import.
• package.json — remove "lodash": "^4.18.1" from dependencies.
• package-lock.json — regenerated; lodash has no transitive deps, so only its own entry is dropped.

Verification

• grep -rn "lodash\|_\." ext-antora ext-asciidoc → only a comment remains, no real usage.
• Loading the extension no longer references lodash (it now reaches the cheerio require, past the old line 5).
• package-lock.json no longer contains a node_modules/lodash entry.

No behavioral change.

🤖 Generated with Claude Code

[DeepDiver1975]

🤖 Automated review by Claude Code review agent.

Verdict: clean removal of an unused dependency — verified safe.

I cloned the PR branch (chore/drop-unused-lodash-dep) and confirmed the central correctness claim independently:

• No remaining bare lodash references. grep -rniE "require\(['\"]lodash['\"]\)|from ['\"]lodash['\"]|require\(['\"]lodash/|from ['\"]lodash/" over the whole tree returns nothing. The removed const _ = require('lodash') in ext-antora/generate-index.js was the only one, and _ is never called in that file.
• The only surviving _. token is a comment in ext-asciidoc/remote-include-processor.js:112 (// Q: use _.difference(...)) — not real usage, correctly left untouched.
• Consistent across the three files: dropped from package.json dependencies, and the node_modules/lodash block + the lockfile dependencies entry are both gone. The node_modules/lodash entry is fully removed (verified absent).
• lodash.clonedeep and lodash.merge remain — these are separate standalone packages (transitive deps), distinct from the lodash monolith, and are correctly preserved.

Checks: Both green — Build documentation (pass) and lint (pass). mergeStateStatus is BLOCKED only because branch protection requires a review (REVIEW_REQUIRED), not because of any failing/pending check; mergeable: MERGEABLE (no conflicts).

No behavioral change. LGTM.