fix: harden pnpm audit overrides for new advisories

[isaque-bock-azion]

Summary

The Security Scans → "Audit dependencies" step (pnpm run security:audit = pnpm audit) in governance.yml started failing on three transitive advisories that the existing pnpm-workspace.yaml overrides no longer cover. Example failing run: runs/30902738667 · Security Scans (exit 1, 1 moderate | 2 high).

This is a repo-wide gate (it fails on every open PR, e.g. #850), so the fix lands in its own PR off main per the dependency-change convention; merging it unblocks the audit step everywhere.

The three advisories

Package	Advisory	Severity	Path(s)	Fix
brace-expansion	GHSA-rgw5-rvv9-x895 — DoS, CVE-2026-14257 mitigation bypass	high	@typescript-eslint/*, eslint, … → minimatch → brace-expansion	bump existing override >=5.0.8 → >=5.0.9
fast-uri	GHSA-7p8r-x3mc-p8w7 — host confusion via backslash	high	@commitlint/*, stylelint → ajv → fast-uri	add >=3.1.5 <4
hono	GHSA-8j4g-w8fx-2239 — ReDoS in CORS middleware	moderate	@modelcontextprotocol/sdk → (@hono/node-server →) hono	add >=4.12.34 <5

Why these bounds

Each force stays inside the dependents' expected major so nothing else in the tree breaks:

• fast-uri bounded to <4 — ajv pins ^3.
• hono bounded to <5 — the MCP SDK pins ^4.
• brace-expansion stays in major 5, kept there by the existing minimatch: ">=9.0.0" override.

The brace-expansion comment now references the superseding advisory (GHSA-rgw5-rvv9-x895) instead of the older GHSA-mh99-v99m-4gvg it already patched.

Verification

• pnpm install --lockfile-only resolves brace-expansion@5.0.9, fast-uri@3.1.5, hono@4.12.34.
• pnpm audit → No known vulnerabilities found (exit 0), down from 1 moderate | 2 high.
• Diff is limited to pnpm-workspace.yaml (4 lines) and pnpm-lock.yaml.

Release effect: fix → patch.

[CLAassistant]

All committers have signed the CLA.