fix(deps): raise the postcss floor to 8.5.18 (unblocks all CI)

[adamXbot]

Why CI went red everywhere

A new PostCSS advisory published — GHSA-r28c-9q8g-f849, path traversal via sourceMappingURL auto-loading that discloses arbitrary .map files, fixed in 8.5.18.

pnpm audit --prod gates the quality job, so this single advisory turned main's Docker publish and all four open PRs red simultaneously, with nobody having changed any code:

Surface	Failing job	Cause
main (Build & Push Docker image to GHCR)	quality	this advisory
#138, #140, #133, #125	quality	this advisory
#132 additionally	preview-image	unrelated — TypeScript v7 major

The fix

An override for postcss already existed at ^8.5.12 — but a caret is not a floor that moves. The committed lockfile had resolved 8.5.17, which is vulnerable. Raising the override to ^8.5.18 and regenerating resolves 8.5.23.

This is the same mechanism, in the same file, as the existing sharp and @babel/core entries. The header comment now records why the caret alone wasn't sufficient, because this will recur the next time an 8.5.x advisory lands.

Verification

• pnpm audit --prod → no known vulnerabilities
• pnpm typecheck clean, 441 unit tests pass, pnpm lint clean
• Full production build succeeds and emits CSS correctly — postcss is the stylesheet pipeline, so the build is the real canary here rather than the audit result

Merge order

Merging this first makes main green again. #138 and #140 have the same commit cherry-picked onto them so they're green independently of merge order (identical patches drop out cleanly on rebase).

🤖 Generated with Claude Code