Security dep-bump workflow in getsentry/spotlight

Pattern for resolving Dependabot alerts in getsentry/spotlight: (1) fetch alerts via gh api /repos/{owner}/{repo}/dependabot/alerts; (2) plan fix in .opencode/plans/; (3) bump pnpm overrides in root package.json AND direct deps in affected packages/*/package.json; (4) run pnpm install, verify lockfile, run full pnpm build + vitest run; (5) create branch security/deps-<descriptor> off main, commit, push, open PR. Vite major-version overrides must be bounded (e.g. <8). Untracked .opencode/ and packages/website/content.config.ts are intentionally excluded from commits; .lore.md is always staged via git add .lore.md alongside code changes. E2E UI test flakes are known — rerun before investigating. Playwright Chromium binary download/extraction can hang indefinitely in this environment; verify E2E fixes via CI rather than local Playwright runs.