fix(deps): raise postcss security floor

[drewstone]

Raise the workspace PostCSS override floor to 8.5.26, above the published 8.5.18 fix, and refresh lock metadata.

Verification: pnpm install --frozen-lockfile --ignore-scripts, pnpm typecheck, and pnpm test passed (683 tests). The lock resolves postcss 8.5.26.

[tangletools]

✅ Auto-approved drewstone PR — feb1ab80

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-03T03:44:39Z}