chore(deps): fix pnpm audit findings (undici, postcss, nanoid)

All seven findings were transitive-only, so each is resolved with a
comparator-scoped override in pnpm-workspace.yaml:

- undici: the existing `undici@>=6.0.0 <6.27.0` override pinned 8.8.0,
  which is itself vulnerable. Replaced with `undici@<8.9.0: ^8.9.0`,
  which covers both the original 6.x range and the vulnerable 8.0-8.8
  line. Reached via @actions/core and @actions/github.
- postcss: `postcss@<8.5.23: ^8.5.23`, reached via vite.
- nanoid: `nanoid@<3.3.17: ^3.3.17`, reached via postcss.

All bumps stay within the installed major, so no breaking changes.
`pnpm audit --audit-level=low` is clean and the test suite passes.

Refs GHSA-4cwx-7wf7-3272,
GHSA-8xcm-r25x-g524,
GHSA-m8rv-5g2x-5cg5,
GHSA-jr45-8vmc-qm54,
GHSA-v3r7-h72x-cjcm,
GHSA-fxqj-rqcc-2cmp,
GHSA-2v37-7h3g-55p8

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: mcalthrop

pnpm-lock.yaml

@@ -1,6 +1,13 @@
 overrides:
   "rollup@>=4.0.0 <4.59.0": "4.62.2"
-  "undici@>=6.0.0 <6.27.0": "8.8.0"
+  # 2026-08-10: undici <8.9.0 — GHSA-4cwx-7wf7-3272 (high), GHSA-8xcm-r25x-g524,
+  # GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm (moderate).
+  # Supersedes the earlier <6.27.0 override, which pinned the now-vulnerable 8.8.0.
+  "undici@<8.9.0": "^8.9.0"
   "picomatch@<2.3.2": ">=2.3.2"
   "yaml@>=2.0.0 <2.8.3": ">=2.8.3"
   "@babel/core@<7.29.1": "7.29.7"
+  # 2026-08-10: postcss <=8.5.22 — GHSA-fxqj-rqcc-2cmp (moderate)
+  "postcss@<8.5.23": "^8.5.23"
+  # 2026-08-10: nanoid <3.3.17 — GHSA-2v37-7h3g-55p8 (high)
+  "nanoid@<3.3.17": "^3.3.17"