fix(deps): resolve open Dependabot alerts

[drewstone]

Summary

Resolves all 10 open Dependabot alerts (1 high, 8 moderate, 1 low) via minimal pnpm override floor bumps and a regenerated lockfile.

Alert	Package	Severity	From	To
#8	postcss	high	<=8.5.17	8.5.26 (override already on main)
#15	postcss	moderate	<=8.5.22	8.5.26 (override already on main)
#4	hono	moderate	>=4.11.8, <4.12.27	4.13.5
#5	hono	moderate	>=4.3.3, <4.12.27	4.13.5
#6	hono	moderate	>=4.0.0, <4.12.27	4.13.5
#9	hono	moderate	<4.12.34	4.13.5
#10	hono	moderate	>=4.12.0, <4.12.34	4.13.5
#11	hono	low	>=4.7.0, <4.12.34	4.13.5
#12	hono	moderate	>=3.8.0, <4.12.34	4.13.5
#7	@hono/node-server	moderate	>=2.0.0, <=2.0.9	2.1.1

pnpm-workspace.yaml overrides now pin hono: '>=4.12.34' and '@hono/node-server': '>=2.0.10', matching the existing postcss: '>=8.5.26' floor pattern. The lockfile was regenerated with pnpm install.

Notes

The prior WIP commit on this branch (039ad9b) had produced an untested, internally inconsistent lockfile that dropped unrelated cross-platform optional package entries (lightningcss-* platform binaries, @rolldown/binding-android-arm-eabi). This PR resets pnpm-lock.yaml/pnpm-workspace.yaml to origin/main and reapplies only the targeted version-floor bumps, verified with pnpm install --frozen-lockfile.

Gates run (worktree, Node 24.18.0, pnpm 10.33.4, NODE_OPTIONS=--no-network-family-autoselection)

Command	Result
pnpm install --frozen-lockfile	pass — lockfile up to date, resolution step skipped
pnpm check:source	pass
pnpm typecheck	pass
pnpm test	pass — 54 test files, 683 tests
pnpm build	pass
pnpm check:package	pass

Test plan

• pnpm install --frozen-lockfile succeeds (proves lockfile consistency)
• pnpm typecheck clean
• pnpm test — 683/683 passing
• pnpm build succeeds
• pnpm check:package succeeds
• CI green on this PR