fix(deps): pin safe postcss floor

[drewstone]

Summary

• Add a workspace override requiring postcss >=8.5.18.
• Keep the current lock resolution at postcss 8.5.26.
• Remediate Dependabot high alert fix(release): publish generated tag in same workflow #8 (GHSA-r28c-9q8g-f849).

Verification

• pnpm install --frozen-lockfile
• pnpm check:source
• pnpm check:package
• pnpm typecheck
• pnpm test -- --reporter=dot (54 files, 683 tests passed)
• pnpm build
• pnpm audit --prod --audit-level high --json (0 high, 0 critical)
• git merge-tree --write-tree origin/main HEAD

No high or critical alerts are dismissed.

[tangletools]

✅ Auto-approved drewstone PR — 4614d76d

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-02T06:28:10Z}