chore(deps): fix pnpm audit findings (undici, postcss, nanoid)

[mcalthrop]

Clears all seven pnpm audit findings (scope: all severities — 2 high, 5 moderate). Every finding was transitive-only, so each is fixed with a comparator-scoped override in pnpm-workspace.yaml. No direct dependency needed bumping, and nothing was suppressed via ignoreGhsas.

Transitive overrides

Module	Installed	Override	Reached via
undici	8.8.0	undici@<8.9.0 → ^8.9.0	@actions/core, @actions/github
postcss	8.5.20	postcss@<8.5.23 → ^8.5.23	vite
nanoid	3.3.16	nanoid@<3.3.17 → ^3.3.17	vite → postcss

All three stay within the installed major, so there is no API-break risk for the parents.

Note on undici

The pre-existing override was "undici@>=6.0.0 <6.27.0": "8.8.0" — an exact pin that had itself become vulnerable. It is replaced by "undici@<8.9.0": "^8.9.0", which still covers the original 6.x range and the newly-vulnerable 8.0–8.8 line, and uses a caret range so future patch releases in the 8.x line flow through without another manual override bump.

Advisories fixed

• undici — GHSA-4cwx-7wf7-3272 (high) — cross-user information disclosure and parse-time crash via degenerate private cache directives
• undici — GHSA-8xcm-r25x-g524 (moderate) — downstream response desynchronisation via retry interceptor
• undici — GHSA-m8rv-5g2x-5cg5 (moderate) — CRLF injection via blob-like body type property
• undici — GHSA-jr45-8vmc-qm54 (moderate) — cross-user information disclosure via whitespace around equals in Cache-Control directives
• undici — GHSA-v3r7-h72x-cjcm (moderate) — cookie attribute injection via unsanitised domain and unparsed setCookie fields
• nanoid — GHSA-2v37-7h3g-55p8 (high) — custom generators can loop indefinitely when size is zero
• postcss — GHSA-fxqj-rqcc-2cmp (moderate) — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset

Verification

• pnpm install --frozen-lockfile — clean, no specifier drift
• pnpm test — 26 tests across 10 files pass, 100% coverage
• pnpm audit --audit-level=low — no known vulnerabilities found

🤖 Generated with Claude Code