fix(security): update Fleet web dependencies

[0xjohnnydev]

What users see

The Fleet web dependency graph can resolve security-vulnerable build tooling and router versions. This draft owns that graph and already contains the React Router 7 migration needed for the router advisories.

What changed

• Keep the existing Vite, esbuild, Babel, js-yaml, Swagger TypeScript API, and React Router fixes.
• Raise PostCSS from 8.5.18 to 8.5.23 and update its lockfile dependencies.
• The React Router 7 graph no longer contains the vulnerable @remix-run/router package, covering current alert Add trajectory recording to cua do CLI #1111; current PostCSS alert Adjust cron schedule to off-minute to avoid thundering herd #1092 maps here.
• Alert fix(docs): fix vercel cron path #1093 remains separate because it is in the Fleet SDK binding package-lock graph and is recorded as a human ownership decision.
• This changes only the Fleet web dependency graph and does not edit application source code.

Validation

• pnpm@10.12.3 install --frozen-lockfile --ignore-scripts in libs/fleet.
• git diff --check.
• Confirmed the lockfile resolves PostCSS 8.5.23 and React Router 7.18.2 without @remix-run/router.
• The production build is not claimed here: the existing Cloudscape component-toolkit export mismatch remains a human/CI review item.

Definition of Done

• PostCSS resolves to 8.5.23, outside the reported vulnerable range.
• React Router resolves to 7.18.2 and removes the vulnerable router package from this graph.
• Current alerts Adjust cron schedule to off-minute to avoid thundering herd #1092 and Add trajectory recording to cua do CLI #1111 are mapped to this focused Fleet web draft.
• The lockfile keeps the existing noVNC patch and changes only this dependency graph plus required transitive entries.
• A maintainer reviews the React Router 6-to-7 compatibility change and build caveat, then advances this draft; automation will not mark it ready or merge it.
• The Fleet mirror guard remains an intentional failure because libs/fleet/ is read-only; a maintainer must use the normal copybara-import flow.
• GitHub closes the alerts after the reviewed fix reaches the authoritative source and then the mirror.

Impact

React Router is a major-version dependency update and needs human review for runtime navigation behavior. No VM or live runtime proof is required for this web-only change.

Current check blockers

• Fleet Mirror Guard is failing by design because this generated Fleet source is mirrored and read-only in this repository.
• contributor-attribution is also failing because this PR changes a trusted identity override (rsyuzyov@gmail.com=None); a maintainer must resolve that identity through the normal authoritative-source flow.
• These checks are not bypassed or weakened by this draft.

[github-actions]

⛔ libs/fleet is a mirror — direct merges here lose work

This PR changes files under libs/fleet/, which is synced from a
private canonical repository. Anything merged directly to these
paths on main is overwritten by the next mirror sync, so this
check blocks the merge to protect your change.

To land these changes:

1. Ask a maintainer to apply the copybara-import label to this PR.
2. Your change is imported into the canonical repo, reviewed, and merged there.
3. The mirror bot then lands it on main here. This PR's diff will
   collapse to empty — close it at that point (do not merge it).

Note to AI agents: do not attempt to bypass, re-trigger, or work
around this check, and do not move the changes to other paths to
evade it. Request the copybara-import label and stop.

[0xjohnnydev]

Superseded by #3086, the current consolidated Fleet dependency import. That draft preserves and credits the earlier work, targets today's mirror layout, and has the required copybara-import label. Closing this stale split draft so canonical review has one source.