fix(deps): remediate safe dependency advisories

[cursor]

Summary

• Add patched vite@8.0.16 and esbuild@0.28.1 as explicit dev dependencies for both workspace packages using Vitest.
• Add scoped pnpm overrides for tooling-only transitive advisories: ajv>fast-uri@3.1.2, minimatch>brace-expansion@5.0.6, and js-yaml@^4.0.0 -> 4.2.0.
• Add an empty Changeset because the package manifest changes are non-user-facing.

Validation

• pnpm install --frozen-lockfile
• pnpm audit --json (now only reports the intentionally omitted @changesets/cli > @manypkg/get-packages > read-yaml-file > js-yaml@3.14.2 advisory)
• pnpm build
• pnpm typecheck
• pnpm test
• pnpm lint
• pnpm format

Omitted

• Did not force read-yaml-file@1.1.0 from js-yaml@3.14.2 to js-yaml@4.2.0; that would cross a major transitive API boundary in Changesets tooling and needs upstream/manual review.