fix(deps): clear pnpm audit critical+high — protobufjs ACE override, next 16.2.9, transitive bumps

[sharp-resolver]

Summary

Clears the 1 critical + 22 high findings from pnpm audit --prod (Sentinel dependency-audit sweep, crew task #359). Audit now reports 0 critical / 0 high (15 moderate remain — explicitly out of scope for this task).

Changes

Package	Before	After	Why
protobufjs (transitive: posthog-js → @opentelemetry)	7.5.4	7.6.3 via pnpm override ^7.5.8	CRITICAL arbitrary code execution GHSA-xq3m-2v4x-88gg (<7.5.5) + 4 HIGH (GHSA-75px-5xx7-5xc7, GHSA-66ff-xgx4-vchm, GHSA-685m-2w69-288q, GHSA-jvwf-75h9-cwgg) + GHSA-jggg-4jg4-v7c6 (≤7.5.7). Override stays on major 7 — no breaking change for opentelemetry.
next	16.1.6	16.2.9 (^16.2.9)	8 HIGH: DoS via Server Components ×2, Cache-Components connection exhaustion, middleware/proxy bypass ×4, SSRF via WebSocket upgrades + 2 low cache-poisoning advisories
minimatch (transitive)	10.2.2	10.2.5	2 HIGH ReDoS (GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74) — in-range pnpm update
picomatch (transitive)	2.3.1 / 4.0.3	2.3.2 / 4.0.4	HIGH ReDoS GHSA-c2c7-rcm5-vvqj — in-range pnpm update
lodash-es (transitive)	4.17.23	4.18.1 via override ^4.17.24	HIGH _.template code injection GHSA-r5fr-rjxr-66jc — exact-pinned by chevrotain (under nextra → mermaid), unreachable by pnpm update
@xmldom/xmldom (transitive)	0.9.8	0.9.10 via override ^0.9.10	5 HIGH (XML injection ×4 + uncontrolled-recursion DoS) — exact-pinned by speech-rule-engine (under nextra → mathjax)

Overrides live in pnpm-workspace.yaml (pnpm 11 ignores package.json#pnpm.overrides when a workspace file exists — verified: the package.json form did NOT take effect, the workspace form did).

Verification

• pnpm audit --prod → 0 critical / 0 high (15 moderate, out of scope; mermaid/DOMPurify/yaml etc. under nextra)
• pnpm typecheck → clean
• pnpm build → full pipeline green (stamp-openapi → sitemap → next build on 16.2.9 → locale/anchor fixups → pagefind: 224 pages, 4 locales indexed) — Nextra 4.6.1 is compatible with Next 16.2.9
• pnpm peers check → same single pre-existing twoslash/typescript warning as on main (not introduced here)
• Lockfile holds ONLY patched versions (grep-verified: no protobufjs@7.5.4, lodash-es@4.17.23, @xmldom/xmldom@0.9.8 entries remain)
• Build-stamped artifacts (public/openapi*.json, sitemap.xml) reverted — diff is exactly the 3 dependency files

Type: deps

🤖 Generated with Claude Code

[sharp-resolver]

Re-verified against today's advisory DB (2026-06-18) — still clears everything. This PR is the fix; it just needs merging.

Crew dependency-audit task #799 re-filed the same findings. That's a PR-not-merged gap, not new work: the routine pnpm audit --prod reads main, and main is still vulnerable because this PR is open/unmerged. Fresh audit numbers just now:

	critical	high	moderate	low
origin/main (what #799 reports)	1	23	40	6
this branch	0	0	21	3

critical + high = 0 on the branch. Every package #799 names is at/above its required floor in the lockfile: next@16.2.9 (≥16.2.6), protobufjs@7.6.3 (≥7.6.1), @xmldom/xmldom@0.9.10, lodash-es@4.18.1 (≥4.17.24), minimatch@10.2.5 (≥10.2.3), picomatch@4.0.4 + 2.3.2 (2.3.2 is a valid backport — not flagged). The residual 21 moderate / 3 low are the out-of-scope dompurify→mermaid/posthog chain that #799 itself excludes.

Note the +1 HIGH since this PR opened (22 → 23): a new advisory landed in the last 6 days, and the already-upgraded versions here cover it too — no version bump needed. Branch is 0 commits behind main, MERGEABLE/CLEAN.

No code change for #799 — merging this clears the audit. (Resolver doesn't merge; that's the review gate's call.)