chore(deps): bump oagen to 0.29.0 and oagen-emitters to 0.24.0

[stanleyphu]

Summary

Picks up optionalFields support in mutually-exclusive body groups (workos/oagen#147, released in v0.29.0) and the Python emitter fixes for optional variant members + grouped-param import collection (workos/oagen-emitters#209, released in v0.24.0).

Why now

This unblocks the spec sync in #95. Two of its failures come directly from generating with the old versions:

• sdk_build (python): F821 Undefined name 'CreateUserPasswordSaltPosition' — the grouped-param import-collection bug fixed in emitters v0.24.0
• sdk-compat: password_salt_position reported as a breaking required addition to PasswordHashed — with v0.29.0 the parser reads optionalFields and the field generates as optional (| None = None), which is non-breaking

Verified by generating Python locally with these exact released versions against #95's spec: the import is present and the field is optional. (Remaining breaking changes in #95's report, if any, are from other spec changes in the sync window, not this.)

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR upgrades the Oagen parser and emitters to versions that support optional fields in mutually exclusive body groups and fix Python generation issues.

• Updates @workos/oagen from 0.28.1 to 0.29.0.
• Updates @workos/oagen-emitters from 0.22.0 to 0.24.0.
• Deduplicates the emitter package's Oagen dependency.
• Records the upgraded tarballs through a new nonstandard registry proxy.

Confidence Score: 4/5

The PR appears safe to merge, though the two proxy-specific lockfile URLs should be regenerated against the standard npm registry to keep installation portable.

The dependency versions and deduplicated tree are internally consistent, and the only accepted concern is the lockfile's new reliance on a nonstandard tarball host.

Files Needing Attention: package-lock.json

Important Files Changed

Filename	Overview
package.json	Updates the two compatible Oagen development dependency ranges; no manifest-level defect was identified.
package-lock.json	Locks the expected upgraded and deduplicated dependency tree, but introduces nonstandard proxy URLs for both upgraded tarballs.

Prompt To Fix All With AI

### Issue 1
package-lock.json:1305
**Avoid proxy-specific tarball URLs**

The upgraded packages are now locked to `socket-firewall.workos.dev`, making reproducible installs dependent on a nonstandard host that the repository does not configure. Regenerate these lock entries against the standard npm registry so contributors and CI environments are not unnecessarily coupled to the proxy.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "chore(deps): bump oagen to 0.29.0 and oa..." | Re-trigger Greptile}

[greptile-apps]

Avoid proxy-specific tarball URLs

The upgraded packages are now locked to socket-firewall.workos.dev, making reproducible installs dependent on a nonstandard host that the repository does not configure. Regenerate these lock entries against the standard npm registry so contributors and CI environments are not unnecessarily coupled to the proxy.

Prompt To Fix With AI

This is a comment left during a code review.
Path: package-lock.json
Line: 1305

Comment:
**Avoid proxy-specific tarball URLs**

The upgraded packages are now locked to `socket-firewall.workos.dev`, making reproducible installs dependent on a nonstandard host that the repository does not configure. Regenerate these lock entries against the standard npm registry so contributors and CI environments are not unnecessarily coupled to the proxy.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[gjtorikian]

I sorted this out #95