The _swampClub module-level singleton was keyed on nothing — once created
for issue #N, every subsequent getSwampClub() call returned the same
client regardless of the new issueNumber in globalArgs. Since user models
are loaded via dynamic import() in the same process, the module stays
cached across method calls, so running start for issue #10 and then
issue #20 in the same session silently sent #20's lifecycle entries,
type updates, and status transitions to #10.

Drop the cache entirely and call createSwampClubClient directly at each
use. The reachability check is a single 5s-timeout HTTP GET and runs
once per method invocation — negligible next to the lifecycle POST
already happening on the same code path.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Bump promptfoo from 0.121.3 → 0.121.4 and regenerate the lockfile. The
new release naturally pulls patched versions of every transitive dep
that was previously pinned via an override, so the entire `overrides`
block can go.

Clears 4 open Dependabot alerts against
`evals/promptfoo/package-lock.json`:

| # | Package | GHSA | Severity |
|---|---|---|---|
| 11 | mathjs | GHSA-jvff-x2qm-6286 | high |
| 10 | basic-ftp | GHSA-6v7q-wjvx-w8wg | high |
| 9 | axios | GHSA-3p68-rc4w-qgx5 | critical |
| 8 | basic-ftp | GHSA-chqc-8p9q-pq6q | high |

Root cause: #1158 added `axios` and `basic-ftp` overrides but the
lockfile was never regenerated, so the committed lockfile still had
`[email protected]` and `[email protected]`. The `basic-ftp: >=5.2.1` range
also still allowed the vulnerable 5.2.1 per alert #10, and there was
no override at all for mathjs.

Resolved versions in the regenerated lockfile:

| Package | Was | Now |
|---|---|---|
| @anthropic-ai/sdk | 0.81.0 | 0.82.0 |
| axios | 1.14.0 | 1.15.0 |
| basic-ftp | 5.2.0 | 5.2.2 |
| mathjs | 15.1.1 | 15.2.0 |
| hono | 4.12.12 | 4.12.12 |
| @hono/node-server | 1.19.13 | 1.19.13 |

No nested/duplicate copies of axios, basic-ftp, or mathjs remain in
the lockfile.

Verification:
- `npm audit` → 0 vulnerabilities
- `deno run scripts/audit_deps.ts` → "No known vulnerabilities found"
  (scanned 1064 packages across deno.lock + promptfoo lockfile)
- `deno fmt --check`, `deno lint`, `deno check` — clean

No code changes required. The eval entry script calls `npx promptfoo
eval` — a stable CLI surface — and a patch bump (0.121.3 → 0.121.4)
is not expected to change it. Engine requirement unchanged
(`^20.20.0 || >=22.22.0`); CI uses Node 24.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>