[codex] Remediate nanoid advisory

[nahremenkova1]

Summary

• add an npm override for nanoid 3.3.17 to remediate GHSA-2v37-7h3g-55p8
• refresh package-lock.json so the resolved nanoid version is no longer vulnerable

Verification

• npm audit --audit-level=moderate: passed, found 0 vulnerabilities
• npm test: passed, 4 files / 12 tests
• npm run typecheck: passed
• npm run build: passed

Follow-up from OPE-1965 daily SDK review.

[nahremenkova1]

QA Sign-Off

Recommendation: merged

Validation:

• GitHub CI: green before merge (Unit Tests and CodeQL completed successfully on 81dd202).
• Local matrix: npm ci, npm audit --audit-level=moderate, npm test (4 files / 12 tests), npm run typecheck, npm run build all passed.
• Diff review: package.json/package-lock.json only; nanoid override added at 3.3.17.
• Security hold: no PR comments and no SECURITY-HOLD found.
• Coverage: no coverage script/report present in this repo, so no measurable coverage drop was detected.
• Repo QA docs: agents/qa-agent.md and specs/21-task-completion-and-blockers.md were not present on default or PR branch; applied the task-level validation holds.

Merged via squash: a410df7