Always bound pnpm overrides to prevent major version migrations

The user consistently applies pnpm version overrides with bounded ranges (e.g., 'vite@>=7.0.0 <7.3.5': '>=7.3.5 <8') and reverts any override that would force a major version jump (astro 6→7 pulling vite 8, react-router 7→8, or brace-expansion 2.x→5.x breaking the build). When a security fix can only be fully resolved by a breaking major migration, the user defers it to a separate dedicated PR. Keep overrides minimal and scoped to the vulnerable range; never let an override unintentionally pull in unrelated major version upgrades or break the build.