chore: resolve dependabot security alerts

[MarshallOfSound]

Safe-only sweep of open Dependabot security alerts. Lockfile-only changes — both vulnerable transitives were refreshed within their existing semver ranges via yarn up -R, no package.json or resolutions changes required.

Package	Strategy	Version change
picomatch	yarn up -R (transitive, within ^4.0.3)	4.0.3 → 4.0.4
tar	yarn up -R (transitive, within ^7.5.4)	7.5.10 → 7.5.13

Both picked versions are older than the configured npmMinimalAgeGate (7 days).

yarn install --immutable passes and yarn npm audit --all --recursive is clean.

Flagged (not changed)

None.

Notes: picomatch@2.3.2 remains in the tree via micromatch but is outside the advisory's vulnerable range (>= 4.0.0, < 4.0.4). The pre-existing @types/node peer warning is unrelated to this change.