chore(webapp,supervisor,core): move socket.io to 4.8.3 - #4635

Summary

socket.io was pinned at exactly 4.7.4 in three manifests (apps/webapp, apps/supervisor, packages/core). That pin capped engine.io at 6.5.4, because 4.7.4 declares engine.io: ~6.5.2.

Moving all three pins to 4.8.3 lifts that cap: 4.8.3 declares engine.io: ~6.6.0. The webapp's direct engine.io devDependency moves from ^6.5.4 to ^6.6.7 to match.

These are direct dependencies, so they are bumped in place rather than forced with an override.

Result

The tree previously carried two engine.io copies. It now carries one:

engine.io@6.6.8
└─┬ socket.io@4.8.3
  ├── @trigger.dev/core (dependencies)
  ├─┬ react-email
  │ └── emails (devDependencies)
  ├── supervisor (dependencies)
  └── webapp (dependencies)

react-email was already resolving socket.io@4.8.3 in this same tree, so that combination was already running here before this change.

Servers move, clients do not

This bumps socket.io (the server) only. socket.io-client stays at 4.7.5 in packages/core and packages/cli-v3, deliberately: the fix is server-side, and clients ship inside user deployments, so leaving them alone keeps the blast radius small. That means a 4.8.3 server will be talking to 4.7.5 clients indefinitely, which is worth being explicit about.

That pairing is safe because neither wire protocol changed. Both versions report the same protocol numbers:

The version bump moves socket.io-parser 4.2.6 to 4.2.7 and engine.io 6.5.4 to 6.6.8, but the protocol constants each exports are unchanged. The 4.8.0 changes are additive on the client (custom transport implementations, a tryAllTransports option) and bug fixes on the server.

Verified rather than assumed, with a cross-version matrix covering both transports and both directions:

PASS  server 4.8.3 <- client 4.7.5   websocket / polling
PASS  server 4.8.3 <- client 4.8.3   websocket / polling
PASS  server 4.7.4 <- client 4.7.5   websocket / polling
PASS  server 4.7.4 <- client 4.8.3   websocket / polling

Each case exercised connect, a server-initiated emit, emitWithAck, room join, room broadcast, and a binary payload. Compatibility holds in both directions, so there is no upgrade-ordering requirement between server and client.

pnpm run typecheck passes across all 57 workspaces.

Stacked on #4634.