build(deps): re-derive the lockfile from the declared state after the merge

The vitest move was originally taken with `pnpm update`, which re-resolves the
whole updated SUBTREE and not just the package named: it dragged second,
patch-level copies of postcss (8.5.28 beside 8.5.26) and picomatch (4.0.7
beside 4.0.5) into the tree, plus @inquirer/*, ip-address, type-fest and
seroval — none of them flagged, none of them forced by a flagged bump.

Regenerating from origin/main's lockfile with a plain `pnpm install`, so the
only inputs are the declared ranges and the two override targets this PR
changes, gives a strictly tighter result:

  registry tuples  1372 -> 1370   (was 1372 -> 1373 under `pnpm update`)
  removed 50, added 48, and EVERY added tuple is in a flagged family

Two duplicates collapse and nothing else moves:
  hono      4.12.34 + 4.13.2  ->  4.13.7        (the OSV duplicate)
  tinyexec  0.3.2 + 1.2.4 + 1.3.0  ->  0.3.2 + 1.3.0
    vitest 4.1.10 held 1.2.4; 4.1.11 declares the same `^1.0.2` and dedupes
    onto the 1.3.0 copy that was already in the tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

Author: claude