Bump dev deps and tighten overrides for security advisories

[comphy-bot]

Summary

• Update dev tooling to clear most open Dependabot high-severity advisories on this branch.
• Bump eslint 8.57.1 -> 10.8.0, @eslint/js 8.57.1 -> 10.0.1, globals 13.24.0 -> 17.8.0, jest 30.3.0 -> 30.4.2, markdownlint-cli2 0.23.0 -> 0.23.2.
• Add an explicit nanoid override and refresh postcss / js-yaml resolved versions via existing overrides.

Changes

• devDependencies updated (eslint, @eslint/js, globals, jest, markdownlint-cli2).
• overrides block: add nanoid: ^3.3.16 to clear transitive nanoid 3.3.12 advisory; existing postcss / js-yaml overrides now resolve patched versions.
• eslint.config.js: disable no-useless-assignment (new eslint 10 recommended rule) so the existing initial-then-overwrite patterns in command-palette.js and utils.js continue to lint cleanly. Patterns can be cleaned up in a follow-up.
• Lockfile refresh via npm install.

Security advisory status

Resolved on this branch:

• postcss path-traversal / source-map advisories (resolved 8.5.15 -> 8.5.25)
• js-yaml flow-collection DoS (resolved 5.2.1 -> 5.2.2)
• nanoid (resolved 3.3.12 -> 3.3.16)

Still open (blocked by npm min-release-age=7 gate, clears 2026-08-13):

• brace-expansion (1.1.17 in test-exclude, 2.1.3 in glob) -- fix requires 1.1.18 / 2.1.4, both published 2026-07-30
• fast-uri 3.1.4 -- fix requires 3.1.5 (2026-07-31) or 4.1.2 (2026-07-31)

A follow-up PR is queued for 2026-08-13 once those patches clear the gate.

Testing

• npm run lint:js -- passes with 2 pre-existing warnings (unused _error / error).
• npm run lint:css -- passes.
• npm run lint:md -- passes (markdownlint-cli2 v0.23.2, 0 issues).
• npm test -- 13 suites, 85 tests, all passing.
• npm audit -- 4 high-severity advisories -> 2 (the two age-gate-blocked ones above).

Notes

• No production-code (assets/js) changes were necessary; the eslint 10 upgrade surfaced a new rule only.
• Jekyll build not run locally (pre-existing Bundler/Ruby env mismatch unrelated to this change); CI on GitHub Actions is the canonical site-build check.