chore(security): bump sharp to 0.35.3 in twenty-apps example lockfiles (#24717)

## What

Follow-up to #24698. That PR cleared vulnerable `sharp` from the
**root** `yarn.lock`, but the `twenty-apps/*` example projects each
carry their **own** `yarn.lock` and still pulled `sharp@0.34.5`
transitively — keeping the GitHub Dependabot monitor breaching on
libvips **CVE-2026-33327 / -33328 / -35590 / -35591**
(GHSA-f88m-g3jw-g9cj, fixed in `sharp >= 0.35.0`).

In all 10 apps the vulnerable `sharp` came in via `twenty-sdk` (`<
2.29.0`, which declares `sharp: ^0.34.5`). `twenty-sdk >= 2.29.0`
already declares `sharp: ^0.35.3`.

## Approach — parent bump, not a resolution

Following the repo convention (prefer a parent-package bump; add a
`resolutions` entry only where no parent upgrade carries the fix), this
bumps the `twenty-sdk` / `twenty-client-sdk` pair (they are always
released in lockstep) to **`2.31.0`** — the newest **stable**
`twenty-sdk` that is `>= 2.29.0` **and** older than 3 days (respecting
the `npmMinimalAgeGate: 3d`; `2.33.0`/`2.35.0` are too new). No `sharp`
resolutions are added.

`call-recorder` declares `sharp` **directly** (`^0.34.5`), and its
`twenty-sdk@2.31.0-alpha.1` already resolves `sharp@0.35.3`; its direct
range is bumped to `^0.35.3`.

| App | twenty-sdk old → new | sharp now | Method |
|---|---|---|---|
| examples/document-generator | `^2.16.0` → `2.31.0` | 0.35.3 | parent
bump |
| examples/postcard | `2.23.0-alpha.2` → `2.31.0` | 0.35.3 | parent bump
|
| internal/real-estate | `2.23.0-alpha.2` → `2.31.0` | 0.35.3 | parent
bump |
| internal/self-hosting | `2.23.0-alpha.2` → `2.31.0` | 0.35.3 | parent
bump |
| public/discord | `^2.16.0` → `2.31.0` | 0.35.3 | parent bump |
| public/exa | `^2.23.0` → `2.31.0` | 0.35.3 | parent bump |
| public/last-contact | `^2.26.0` → `2.31.0` | 0.35.3 | parent bump |
| public/linear | `^2.16.0` → `2.31.0` | 0.35.3 | parent bump |
| public/people-data-labs | `2.23.0-alpha.2` → `2.31.0` | 0.35.3 |
parent bump |
| public/call-recorder | (SDK already 2.31.0-alpha.1) | 0.35.3 | direct
`sharp` dep `^0.34.5` → `^0.35.3` |

`twenty-client-sdk` is bumped alongside `twenty-sdk` to the same
`2.31.0` so the pair stays consistent and no duplicate copy is
introduced.

## Verification

- Every app `yarn.lock` now resolves `sharp` to `0.35.3` only — **0**
occurrences of `sharp@0.34.*` / `0.33.*`.
- `yarn install --immutable` is consistent in all 10 app dirs (matches
CI).
- `yarn typecheck` (tsgo) passes on all 7 apps that define it; `yarn
lint` passes on all; `yarn test:unit` spot-checked green. No SDK API
drift from the bump.