chore: upgrade website to Next.js 16.4.0

[Copilot]

The website needed an agent-led Next.js upgrade. The dependency cooldown blocked the newly released Next packages.

Changelog

• Changed
  • Upgraded the website from Next.js 16.3.1 to 16.4.0 using next upgrade --agent.
  • Exempted next and @next/* from the dependency cooldown.
  • Enabled security-focused agent upgrades in the website config.

[joshblack]

@copilot see if we can use: https://nextjs.org/blog/next-16-4#additional-roots-and-global-virtual-store-support instead of our injected approach for agent-eval in the website package

[Copilot]

@copilot see if we can use: https://nextjs.org/blog/next-16-4#additional-roots-and-global-virtual-store-support instead of our injected approach for agent-eval in the website package

Yes—commit 7dae163 removes the website’s injected setting and uses the pnpm workspace symlink. Next.js already detects the monorepo root containing packages/agent-eval, so an additional root isn’t needed. Frozen install, type checks, lint, 577 tests, and dev-page smoke tests pass; I skipped the memory-intensive site build.