Always resolve all open Dependabot alerts then release

When Dependabot alerts are present (recurring across sessions, typically transitive runtime vulnerabilities in pnpm-lock.yaml), the user expects the assistant to enumerate and fix ALL open alerts together rather than piecemeal. The established workflow: create a security/deps-* branch, apply fixes (commonly package.json overrides bounded to the current major version to avoid breaking jumps for transitive deps), build and test, open a PR with auto-merge, verify alerts clear post-merge, then publish a new version via the regular release process (Craft workflow_dispatch). Do not leave open alerts unaddressed or handle them one at a time.