fix(deps): patch transitive dependabot vulnerabilities via overrides

Resolve 10 dependabot alerts (7 high, 1 moderate, 2 low) in transitive
deps under @cursor/sdk toolchain:
- undici -> ^6.24.0 (5 advisories: smuggling, CRLF, ws memory/exception, decompression)
- tar -> ^7.5.11 (6 advisories: hardlink/symlink path traversal, race condition)
- node-gyp -> ^12.4.0 (modernizes build toolchain, drops vulnerable @tootallnate/once 1.x)

Author: justin-carper