[Chore] Patch brace-expansion memory exhaustion vulnerability

[roomote-roomote]

Created by Roomote. Follow up by mentioning @roomote-roomote or in the web UI.

What changed

• Updated the affected transitive brace-expansion 1.x and 2.x overrides to patched releases 1.1.17 and 2.1.3.
• Regenerated the pnpm lockfile and allowed these newly published security releases through the repository's minimum release-age policy.

Why this change was made

Dependabot alert #66 reports that unbounded brace expansion can exhaust process memory. The patched releases bound expansion count and output length so attacker-influenced patterns cannot grow without limit.

Impact

There is no intended application behavior change beyond the security bound. The resolved graph now contains only patched brace-expansion releases (1.1.17, 2.1.3, and the existing 5.0.8); the frozen install, repository static gates, and a focused expansion-limit runtime check passed.

[roomote-community]

No code issues found. See task

_{Reviewed b537d31}