web: package.json files say astro ^7.2.8, but the sites build on Astro 6.4.6 #4359

What's wrong

All five static sites (web/sites/{landing,blog,guides,api,packages}/package.json) declare "astro": "^7.2.8", but every install resolves Astro 6.4.6, and that is what builds and deploys.

Which is real, and why pnpm install --frozen-lockfile passes

• 6.4.6 is real. The root web/package.json has pnpm.overrides.astro: "^6.3.1", added in fix(web): upgrade astro 5.x → 6.3.1 and starlight 0.34 → 0.39.2 #2523, which moved the sites from Astro 5 to 6. An override rewrites every request for astro in the workspace, including each site's own dependency, to ^6.3.1.
• The lockfile is consistent with that. web/pnpm-lock.yaml records the overridden specifier (specifier: ^6.3.1, version: 6.4.6) for each site, and lists the override under overrides:. A frozen install compares the lockfile against the effective specifiers after overrides, so it passes.
• The ^7.2.8 came from build(deps): bump astro from 6.4.6 to 7.2.8 in /web #3536 (2026-09-09), which edited the site package.json files; the root override kept every site on 6.4.6.

@wheels-dev/ui also declares a stale peer range, "astro": "^5.0.0".

Consequences

• The manifests tell readers and tools the wrong major version. This already mattered: picking a Starlight plugin version for feat(web): llms.txt, llms-full.txt, llms-small.txt and per-page Markdown for guides and API #4356 depended on knowing the real one.
• Moving to Astro 7 is a real upgrade, not a version bump: Starlight 0.42 requires astro ^7.2.10, and the override has to go. It deserves its own PR and a full build of all five sites.

Fix

Make the manifests say what's installed: the site package.json files back to ^6.3.1 (matching the override), and the ui peer range to ^6.0.0. That's a lockfile no-op. An Astro 7 upgrade can follow separately.