chore(deps): bump esbuild 0.28.0 to 0.28.1 to fix 4 dependabot alerts

Fixes the 4 open dependabot alerts on esbuild < 0.28.1:
  GHSA-... high severity: Missing binary integrity verification in
    Deno module enables remote code execution via NPM_CONFIG_REGISTRY
    (range >= 0.17.0, < 0.28.1; affects 0.28.0)
  GHSA-... low severity: arbitrary file read in dev server on Windows
    (range >= 0.27.3, < 0.28.1; affects 0.28.0)

Resolution:
  ts/package.json (root): no change (esbuild is transitive via tsx).
    Lockfile updated to resolve esbuild 0.28.1 via npm update.
  ts/packages/sdk/package.json: added esbuild ^0.28.1 as an explicit
    devDependency so the resolution is pinned at the package level
    rather than relying on tsx's ~0.28.0 transitive range.
  ts/packages/sdk/package-lock.json: removed. npm workspaces produce a
    single authoritative lockfile at the workspace root (ts/), and the
    child lockfile was a stale artifact that diverged from the root.
    Verified the root lockfile resolves esbuild to 0.28.1 for the sdk
    workspace.

Verification:
  npm run build (sdk): passes
  npm test (sdk): 28 / 28 tests passing
  ruff format / check (Python lint): no changes touched

Author: yfxiao16