fix(deps): pin basic-ftp to patched 5.3.1

[time-attack]

What it does

Fresh gstack installs now resolve basic-ftp 5.3.1 instead of vulnerable 5.2.0. This removes four HIGH-severity basic-ftp findings from the installed dependency tree.

How it works

The root package adds a Bun override for basic-ftp 5.3.1. Regenerating the lockfile updates the single transitive resolution and integrity hash, so all paths through get-uri and the browser dependency tree load the patched release.

What was broken

Fresh gstack installs loaded basic-ftp 5.2.0. GitHub's advisory database reports four HIGH advisories affecting that release, including a denial-of-service issue whose first patched version is 5.3.1.

How it was fixed

I added the root override, regenerated bun.lock, and added a focused regression test. The test checks both the declared override and every basic-ftp version in the lockfile so a vulnerable nested resolution cannot silently return.

Live evidence

The pr-test-env harness used immutable origin/main at 7c9df1c568a9 and separate baseline/candidate directories and HOME roots. The same installed-runtime command was replayed in every candidate environment.

Repository	Cohort	Baseline	Candidate
OneManCompany	with-gstack	5.2.0, exit 1	5.3.1, exit 0
GBrain	with-gstack	5.2.0, exit 1	5.3.1, exit 0
Zotero Arxiv Daily	with-gstack	5.2.0, exit 1	5.3.1, exit 0
Plane	clean control	5.2.0, exit 1	5.3.1, exit 0
Twenty	clean control	5.2.0, exit 1	5.3.1, exit 0

Gate result: PASS, five fail-to-pass reproductions, identical command hash 7b0b236926603b25e947019e55b3f4e3d9bac6f13b546018230b330e70efa868.

bun audit --json listed these findings on baseline and none for basic-ftp on candidate:

• GHSA-rpmf-866q-6p89
• GHSA-rp42-5vxx-qpwr
• GHSA-6v7q-wjvx-w8wg
• GHSA-chqc-8p9q-pq6q

Runtime smoke: runtime basic-ftp=5.3.1 client=Client.

Secondary checks

• bun test test/basic-ftp-security-pin.test.ts — pass
• bun run build — pass; existing non-fatal Factory token-ceiling warning remains
• git diff --check — pass

Scope and remaining risk

This proves patched dependency selection and runtime loading, not a live exploit replay against a malicious FTP server. Unrelated audit findings are intentionally outside this patch. No VERSION, package version, or CHANGELOG.md changes are included.