getsentry/craft: tar is a pinned devDep (no caret) — must bump the pin directly, not via override

Trap: tar looks like a transitive dep that should be fixed via pnpm.overrides, because most security fixes use overrides. Fix: tar@7.5.11 is a direct devDependency pinned without a range operator at package.json:65 — bump the pin directly to 7.5.16 and run pnpm install. An override would be redundant and confusing. Vulnerable range: <= 7.5.15 (GHSA-vmf3-w455-68vh, Alerts #180/#181). Confirmed tar@7.5.16 exists on npm. Applied in branch byk/fix/dependabot-security-alerts.