chore: remediate dependency vulnerabilities (picomatch, postcss, rollup)

[devin-ai-integration]

Summary

Lockfile-only bump to clear the open security findings for this repo. All three packages are transitive dev deps (vite / vitest / tsdown toolchain) and the fixed versions satisfy the existing ranges, so package.json is untouched (pnpm install --lockfile-only after pnpm update --depth Infinity):

• picomatch 2.3.1 → 2.3.2 and 4.0.3 → 4.0.5 (CVE-2026-33671, CVE-2026-33672)
• postcss 8.5.6 → 8.5.25 (CVE-2026-41305, CVE-2026-45623, GHSA-r28c-9q8g-f849 — the latter affects ≤ 8.5.17)
• rollup 4.52.2 → 4.62.3 (CVE-2026-27606)

Verification: pnpm lint and pnpm test (146 tests, node + edge) pass. pnpm build fails with Failed to import module "unrun" from tsdown 0.22.14 — reproduced identically on main with the unmodified lockfile, so it is pre-existing and unrelated.

Link to Devin session: https://app.devin.ai/sessions/2216f6167a274f5e86e5ff85a4f7b6f0
Requested by: @requesty-ditti

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3205716

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring