fix(deps): patch nanoid, js-yaml, and postcss advisories (#770)

## Summary

Patches all four currently open Dependabot alerts in `pnpm-lock.yaml`
using narrow root-level pnpm overrides:

- `nanoid` 3.3.16 → 3.3.18 (GHSA-2v37-7h3g-55p8 / CVE-2026-67213)
- `js-yaml` 3.15.0 → 3.15.1 (GHSA-5p4m-2wfm-xmqj)
- `js-yaml` 4.3.0 → 4.3.1 (GHSA-5p4m-2wfm-xmqj)
- `postcss` 8.5.19 → 8.5.23 (GHSA-fxqj-rqcc-2cmp / CVE-2026-69153)

No direct application dependencies or runtime code are changed.

## Validation

- [x] `corepack pnpm install --frozen-lockfile`
- [x] `corepack pnpm format:check`
- [x] Verified patched lockfile resolutions are present and prior
vulnerable resolutions are absent
- [ ] `corepack pnpm lint` — blocked by an `oxlint` allocator panic in
this sandbox (exit 134)
- [ ] `corepack pnpm --filter "./libs/*" typecheck` — blocked by
pre-existing missing `@langchain/sandbox-standard-tests/vitest` build
artifacts/imports in `libs/deepagents`

Scoped to the four open Dependabot alerts.

Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>