fix(security): pin patched dev toolchain dependencies

[mohanagy]

Closes #282.\n\nThis removes the remaining high-severity development-toolchain findings without changing Vitest, coverage thresholds, or production dependency behavior.\n\n- pins patched brace-expansion, glob, and postcss versions only beneath their known direct development dependency ancestry\n- retains the existing runtime Hono pin from #281\n- adds a package/lock contract proving the patched entries are dev-only and preventing future broad root overrides\n\nValidated after rebasing onto development:\n- npm ci\n- npm audit: 0 vulnerabilities\n- release configuration contract\n- npm test\n- npm run test:coverage\n- npm run lint\n- npm run typecheck\n- npm run build\n- npm run smoke:cli\n- npm run check:pack\n- npm run test:package\n\nIndependent local review confirmed that the new overrides are scoped under development dependency ancestry rather than global runtime overrides.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 52 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e159074c-92b3-4612-b961-976880a36925

📥 Commits

Reviewing files that changed from the base of the PR and between 04adcbc and 964e31a.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• tests/release-config.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/282-dev-toolchain-security

---

_{Comment @coderabbitai help to get the list of available commands.}

[mohanagy]

CodeRabbit reached its temporary review limit on this PR. Per repository policy, this is documented rather than waited out: an independent source-level local review completed against this exact diff and found no blocker. It confirmed the new overrides are scoped beneath direct development dependency ancestry, the patched lock entries are dev-only, and the regression contract prevents broad root overrides. Required current-head CI remains the merge gate.

[mohanagy]

Current-head review exception update: CodeRabbit remains rate-limited (52 minutes) after the rebase. Per maintainer authorization, I am not waiting for the quota window.

The current head 964e31a contains the same #282 package override/test diff that received an independent source-level review before rebase, plus merged #287 (04adcbc), whose exact diff has CodeRabbit approval and all platform CI green. No #282 source change was made during rebase. npm audit --omit=optional --audit-level=high at this head reports 0 vulnerabilities.

I will merge only after this current head passes every required CI job. This comment documents the rate-limit exception; it does not claim a CodeRabbit review that did not occur.