chore(deps): finalize security overrides and regenerate lockfile (#1718)

npm does not reliably apply these transitive overrides to an existing
lockfile (bare and targeted overrides via install/update leave residual
vulnerable copies). This regenerates the lockfile from scratch with
version-targeted overrides so every copy of the affected packages
resolves to a patched version.

Resolves Dependabot alerts:
- esbuild #121 (-> 0.28.1)
- minimatch #69, #66, #61 (3.x -> 3.1.5)
- @babel/core #132 (-> 7.29.7; completes the partial fix from #1712)
Also pins js-yaml overrides (3.15.0 / 4.2.0) to prevent regression.

Supersedes #1713, #1714, #1715. Part of #1706.

Verified: 0 vulnerable copies across all advisories; build + client (535)
+ cli tests pass; lockfile internally consistent.


Claude-Session: https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

package.json

@@ -82,7 +82,11 @@
     "shell-quote": "^1.8.4",
     "hono": "^4.12.25",
     "form-data": "^4.0.6",
-    "@babel/core@<=7.29.0": "^7.29.6"
+    "@babel/core@<=7.29.0": "^7.29.6",
+    "esbuild@<0.28.1": "^0.28.1",
+    "minimatch@<3.1.4": "3.1.5",
+    "js-yaml@<4": "3.15.0",
+    "js-yaml@>=4": "4.2.0"
   },
   "engines": {
     "node": ">=22.7.5"