chore: patch vulnerable transitive dependencies (#2682)

## Summary

Patch the currently open Dependabot alerts in `pnpm-lock.yaml` by
tightening the existing root pnpm overrides and regenerating the
lockfile:

- `js-yaml` 4.x → 4.3.1
- `dompurify` → 3.4.13
- `mermaid` → 11.16.1 (covers five advisories)
- `undici` 6.x → 6.28.0 and 7.x → 7.29.0 (covers seven
advisory/major-version alert instances)
- `postcss` → 8.5.25

The remaining `@hono/node-server` alert is already stale on `main`: the
lockfile resolves 1.19.17 and 2.1.0, both outside the advisory's
vulnerable `<2.0.5` range (the 1.x line is not affected by that range).

## Validation

- `pnpm install --frozen-lockfile`
- `pnpm run format:check`
- Verified every affected package resolution in `pnpm-lock.yaml` is
outside the corresponding vulnerable range

## Scope

Dependency overrides and generated `pnpm-lock.yaml` only; no runtime
code changes.

Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>