chore(deps): remediate vulnerable transitive tooling deps

[cursor]

Summary

• Bump transitive fast-uri from 3.1.0 to 3.1.2 for GHSA-q3j6-qgpj-74h6 / CVE-2026-6321 and GHSA-v39h-62p7-jpjc / CVE-2026-6322.
• Bump transitive brace-expansion from 5.0.5 to 5.0.6 for GHSA-jxxr-4gwj-5jf2 / CVE-2026-45149.
• Apply formatter-only cleanup to generated changelogs and add an empty changeset because this is non-user-facing tooling remediation.

Callers / Risk

• fast-uri is reached only through root dev tooling: @commitlint/cli -> @commitlint/load -> @commitlint/config-validator -> ajv -> fast-uri.
• brace-expansion is reached only through root dev tooling: ultracite -> glob -> minimatch -> brace-expansion.
• Both updates are patch-level transitive lockfile bumps to the lowest versions that clear the advisories; no runtime package manifests changed.

Validation

• pnpm install --frozen-lockfile
• pnpm why fast-uri
• pnpm why brace-expansion
• pnpm audit --audit-level moderate (No known vulnerabilities found)
• pnpm exec commitlint --from origin/main --to HEAD
• pnpm run format
• pnpm run build
• pnpm run lint
• pnpm run typecheck
• pnpm test
• pnpm changeset status --since=origin/main