fix(cli): clear remaining dependency security advisories

[blafourcade]

🎯 What & why

Clear the four remaining CLI dependency advisory IDs after #1011. Both full and production audits now report zero findings.

🛠️ How it works

Raise the existing fast-uri and qs floors to ~3.1.8 and ~6.16.0, and add esbuild ~0.28.2 in pnpm-workspace.yaml:16. pnpm regenerates only these packages, esbuild's platform binaries and qs's side-channel dependency.

Keep Stryker/typed-rest-client and tsup at their existing versions. qs exceeds typed-rest-client's exact pin; esbuild exceeds tsup's declared range. The parent APIs were checked, and real HTTP serialization, CSS/PostCSS, style injection and configuration watch probes pass on the installed graph. These exceptions and upstream sources are recorded in validation.md:1.

Patched esbuild correctly emits TypeScript parameter-property fields that the old compiler omitted, increasing the bundle by 5,008 bytes. Align the measured budget from 751 to 756 KB in the existing registry; application code and minification stay unchanged.

🧪 How to verify

• Fresh frozen installations; typecheck, type honesty, lint, knip and duplication checks pass.
• pnpm audit --json and pnpm audit --prod --json: zero findings.
• pnpm test:coverage: 7,025 passed, one skipped; unchanged coverage thresholds pass.
• Mutation canary: 100/100; duplication: 1.62% below 3.3%; build: 755.6 KB below the documented 756 KB budget.
• fast-uri advisory reproduction is corrected; actual typed-rest-client GET/PUT requests match baseline, and both qs reproductions are corrected.
• Actual tsup CSS extraction/injection and bundle-require watch/rebuild pass with esbuild 0.28.2 and PostCSS 8.5.28.
• CLI CI: all 48 jobs pass, including Windows, all 15 mutation scopes and aggregate score gates. CodeQL, framework CI and Validate also pass on commit 45a5a48f4a8bf40da002cff7abcda71803bff248.

⚠️ Heads-up

The dependency overrides intentionally exceed two parent constraints; compatibility is established for this tested graph, not claimed as upstream support. The bundle budget change reflects the measured compiler correctness fix, with approximately 0.05% headroom. All other thresholds and the Vitest runner patch are unchanged.

🔗 Linked issue

Refs #469. Follows #1011; the discovery report remains in #1010.

✅ I certify

• I DO CERTIFY I READ EACH LINE OF THE PULL REQUEST BECAUSE I AM A SOFTWARE ENGINEER, NOT A AI PUPPY.