fix(deps): pin patched PostCSS in JS workspaces

[cresslank]

What does this PR do?

Pins the root JavaScript workspace graph to PostCSS 8.5.24, the patched release, so transitive consumers cannot continue resolving the vulnerable 8.5.x range. The root lockfile is regenerated without unrelated package upgrades.

Related Issue

No linked issue.

Type of Change

• 🐛 Bug fix
• 🔒 Security fix
• New feature
• Documentation update

Changes Made

• Add a root overrides.postcss pin at 8.5.24.
• Regenerate only the affected root lockfile entries.

How to Test

1. npm ci --include=dev --ignore-scripts
2. npm ls postcss --all — all consumers resolve to 8.5.24.
3. npm audit --workspaces=false and npm audit --workspace ui-tui — zero findings.
4. Build/typecheck @hermes/ink, Desktop, web, and ui-tui.

The web workspace currently reports a separate newly published React Router RSC advisory. Hermes uses Declarative Mode, not the affected Framework/RSC mode, and the only npm-suggested v7 resolution is a downgrade that would reintroduce the older advisory fixed by the intentional 7.17.0 bump. This PR does not mix that separate dependency decision into the PostCSS fix.

Validation

• @hermes/ink build: passed
• Desktop/web/ui-tui typechecks: passed
• ui-tui: 1,376 tests passed, 20 failed; the same subscription-overlay failures and backpressure failure reproduce on the exact unmodified base and are unrelated to this lock-only change
• git diff --check: passed

Checklist

• Read the Contributing Guide
• Conventional commit
• Searched existing PRs
• One focused commit with no unrelated upgrades
• Tested on Fedora Linux
• Config/docs/tool-schema updates: N/A

[alt-glitch]

This was generated by AI during triage.

Related: #73347 has the same root lockfile refresh; this PR additionally adds a root PostCSS override. The shared remediation is not redundant, but the two approaches should be consolidated by a maintainer.

[cresslank]

Rebase note

Rebased onto current main (d26983e48) as a single commit.

• Kept the PostCSS 8.5.24 override
• Merged with main's existing yauzl / protobufjs overrides
• Regenerated root package-lock.json so the tree resolves postcss@8.5.24

[teknium1]

Thanks for the focused dependency-security remediation. Current main still resolves postcss@8.5.15 at package-lock.json:15585, which is within GHSA-r28c-9q8g-f849's vulnerable range through 8.5.17. The PR's root overrides.postcss pin and updated lock resolution address that dependency path; sanitize-html and vite declare compatible PostCSS ranges at package-lock.json:17028 and package-lock.json:18892.

The existing member note identifies overlapping lockfile work in #73347; that consolidation is the remaining maintainer coordination point.

No changes requested. This is an automated hermes-sweeper review.

[cresslank]

Closing as superseded.

Current main already pins overrides.postcss to 8.5.23 (package.json), which is past GHSA-r28c-9q8g-f849's first patched release (8.5.18). This PR's 8.5.24 pin no longer carries unique security value, and #86176 is the live follow-on if maintainers want a newer pin.

No objection to anyone picking up a fresher PostCSS bump from a current-main branch.