fix: remove vulnerable metadata dependencies

[titanism]

Summary

• remove the vulnerable ip and last-commit-log dependency chains
• preserve IPv4 selection with os.networkInterfaces()
• preserve Git metadata with argument-safe git subprocess calls
• update lodash and extend the behavior tests

Validation

• pnpm test
• pnpm audit --prod: 0 advisories