Adds pnpm-workspace.yaml overrides to pin transitive dependencies to patched versions, eliminating all 36 npm audit findings (21 high, 10 moderate, 5 low).#3423