chore(deps): pin postcss override to exact 8.5.26

Replace the patch-level semver cap with an exact pin matching package.json,
consistent with other overrides like esbuild and form-data.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: teallarson

pnpm-lock.yaml

@@ -3,8 +3,8 @@ settings:
   minimumReleaseAge: 10080
 
 overrides:
-  # Force next's transitive postcss to the same safe version as the direct dep. 8.5.23 fixes the sourceMappingURL arbitrary .map file read (GHSA-6g55-p6wh-862q follow-up). Capped below 8.5.27 because later releases are still inside the 7-day minimumReleaseAge window above; raise the cap once they age out.
-  postcss: ">=8.5.26 <8.5.27"
+  # Force next's transitive postcss to the same safe version as the direct dep in package.json. 8.5.23 fixes the sourceMappingURL arbitrary .map file read (GHSA-6g55-p6wh-862q follow-up). Pinned (not a range) because 8.5.27+ are still inside the 7-day minimumReleaseAge window above.
+  postcss: "8.5.26"
   # rule-engine pulls a vulnerable @xmldom/xmldom (XML injection / uncontrolled recursion). 0.9.12 fixes the EntityReference.nodeName fragment injection.
   "@xmldom/xmldom": ">=0.9.12"
   # Force vite's transitive esbuild off the vulnerable dev-server file-read advisory (GHSA-g7r4-m6w7-qqqr)