fix(cli): patch vulnerable development dependencies

[blafourcade]

🎯 What & why

Remove all 12 high-severity development dependency advisories from the CLI graph through six compatible patch upgrades. The full audit falls from 19 advisory IDs to four; production exposure is unchanged.

🛠️ How it works

Set bounded patch ranges for brace-expansion, browserslist, js-yaml, nanoid, postcss and source-map-js in pnpm-workspace.yaml:14, then regenerate the lockfile with pnpm. The lock retains the six tested minimum versions and refreshes four Browserslist data packages. Optional PostCSS peers remain intact; direct dependencies, the Stryker patch and quality thresholds are unchanged.

🧪 How to verify

• Fresh frozen installations, typecheck, type honesty, lint, knip and 168 architecture checks pass.
• pnpm test:coverage: 7,025 passed, one skipped; unchanged coverage thresholds pass.
• Mutation canary: 100/100; duplication: 1.62% below 3.3%; build: 750.7 KB below 751 KB.
• Actual tsup CSS fixture runs its configuration plugin through PostCSS 8.5.28.
• See validation.md:1 for local evidence.
• CLI CI: all 48 jobs pass, including Windows, all 15 mutation scopes and aggregate score gates. CodeQL, framework CI and Validate also pass for commit f1499d2c892a1c7e6c1bf75194b163f300331aed.

⚠️ Heads-up

Four advisories remain: one production moderate fast-uri finding, two development moderate qs findings and one development low esbuild finding. These were explicitly excluded from #1008; no advisory is suppressed. See the audit in #1010.

🔗 Linked issue

Closes #1008

✅ I certify

• I DO CERTIFY I READ EACH LINE OF THE PULL REQUEST BECAUSE I AM A SOFTWARE ENGINEER, NOT A AI PUPPY.