fix(deps): clear 16 runtime Dependabot alerts via pnpm overrides [PLT-2701]

axios, js-yaml, brace-expansion, sharp, @opentelemetry/core and postcss are
all transitive, so pinning floors through pnpm.overrides is the only way to
move them without waiting on each intermediate package to re-release.

  axios               1.16.1 -> 1.19.0    (10 alerts)
  js-yaml             4.1.1  -> 4.3.1     (2)
  brace-expansion     5.0.6  -> 5.0.9     (1)
  sharp               0.34.5 -> 0.35.3    (1)
  @opentelemetry/core 2.2.0  -> 2.10.0    (1)
  postcss                    -> 8.5.25    (1)

js-yaml is capped at ^4.3.0 rather than >=4.3.0: an open range resolves to
5.2.2, whose API is not backwards compatible. postcss needs an explicit floor
because a clean resolve otherwise lands on 8.4.31/8.5.15, both below the
advisory threshold.

next is deliberately left at 16.1.7. The alerts want >=16.2.11, but nextra
4.6.1 generates MDX page wrappers that export `metadata` from a "use client"
component, which next 16.2.x rejects, breaking every .mdx page at build time.
nextra 4.6.1 is the latest stable release, so that bump is blocked upstream
and tracked separately in PLT-2701.

immutable is also held: it is transitive under swagger-ui-react, and 3.8.3 ->
4.3.9 is a major bump that needs its own verification of the API reference.

Verified: pnpm build succeeds, 767 tests pass across 57 files, and lint is
unchanged from main (same 3 pre-existing complexity warnings).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: sdreyer

package.json

@@ -113,5 +113,15 @@
       "pnpm exec ultracite fix"
     ]
   },
-  "packageManager": "pnpm@10.11.0"
+  "packageManager": "pnpm@10.11.0",
+  "pnpm": {
+    "overrides": {
+      "axios": ">=1.18.0",
+      "js-yaml": "^4.3.0",
+      "brace-expansion": ">=5.0.8",
+      "sharp": ">=0.35.0",
+      "@opentelemetry/core": ">=2.8.0",
+      "postcss": ">=8.5.18"
+    }
+  }
 }