fix(security): update docs Sharp dependency

[0xjohnnydev]

Problem

The documentation site previously resolved vulnerable transitive Sharp, js-yaml, tar, and PostCSS releases. These packages are used while building the site.

What changed

• Keep Sharp at 0.35.0.
• Keep js-yaml at 4.3.0 and tar at 7.5.18.
• Raise the documentation PostCSS override from 8.5.10 to 8.5.23 and update the lockfile.
• This draft covers the earlier Sharp/js-yaml/tar alerts and current docs PostCSS alert feat(lume): restructure release binary as .app bundle for bridged networking #1080. Docs Next alerts remain mapped to their existing focused PR.

Definition of Done

• Sharp, js-yaml, and tar resolve outside their reported vulnerable ranges.
• PostCSS resolves to 8.5.23, outside the reported vulnerable range.
• Current alert feat(lume): restructure release binary as .app bundle for bridged networking #1080 is mapped to this same documentation lock graph.
• The frozen install passes with the updated lockfile.
• A maintainer reviews and advances this draft; automation will not mark it ready or merge it.
• GitHub closes the alerts after the reviewed fix reaches the default branch.

Validation

• pnpm@10.12.3 install --frozen-lockfile --ignore-scripts in docs.
• git diff --check.
• Confirmed the lockfile resolves Sharp 0.35.0, js-yaml 4.3.0, tar 7.5.18, PostCSS 8.5.23, and nanoid 3.3.16.

Impact

This changes documentation build dependencies only. No documentation content, VM, installation, or live runtime behavior changed.

[0xjohnnydev]

This dependency graph is now included in draft #2719. That draft keeps each graph independently validated while giving reviewers one dependency-only change instead of several overlapping drafts. Nothing was merged or marked ready, and this branch is preserved.