chore(deps): resolve remaining Dependabot security alerts

[sadjow]

Summary

• update both Yarn lockfiles for all 14 currently open GitHub Dependabot alerts
• patch shell-quote, ws, svgo, postcss, tar, launch-editor, esbuild, and brace-expansion
• add targeted resolutions where the safe esbuild release and the compatible brace-expansion backport fall outside an upstream transitive range
• keep legacy and modern brace-expansion consumers on compatible patched APIs instead of forcing one incompatible major across the graph

Validation

• root frozen Yarn install
• playground frozen Yarn install
• ESLint with zero warnings
• production playground build
• 22 unit tests

The pull request CI will run the complete integration suite on Node 20 and Node 22.