Resolve dependency advisories in lockfiles

[0thernet]

Summary

• Org-wide dependency-audit sweep: bumps, overrides, and surgical lockfile rewrites that clear flagged advisories without re-resolving private or GitHub dependencies.
• bun.lock: @xmldom/xmldom -> 0.8.15 (re-resolved in range)
• bun.lock: plist/@xmldom/xmldom -> 0.9.12 (re-resolved in range)
• bun.lock: brace-expansion -> 1.1.21 (re-resolved in range)
• bun.lock: @expo/fingerprint/minimatch/brace-expansion -> 5.0.12 (re-resolved in range)
• bun.lock: @typescript-eslint/typescript-estree/minimatch/brace-expansion -> 5.0.12 (re-resolved in range)
• bun.lock: glob/minimatch/brace-expansion -> 5.0.12 (re-resolved in range)
• bun.lock: js-yaml -> 4.3.2 (re-resolved in range)
• bun.lock: nanoid -> 3.3.18 (re-resolved in range)
• bun.lock: image-size -> 2.0.4 (forced; importer ranges exceeded)
• bun.lock: uuid -> 14.0.2 (forced; importer ranges exceeded)

Remaining advisories

• braces ['3.0.3'] (GHSA-vfj7-8cjw-p6xm)
• node-forge ['1.4.0'] (GHSA-86w9-cpqp-85rv)

Generated with Devin