brace-expansion 5.0.8 ESM interop breaks Astro build via @vercel/nft glob@13

Trap: forcing brace-expansion to 5.0.8 (only patched 5.x for advisory #323) looks right — it's the security fix. But 5.0.8's CJS build sets Object.defineProperty(exports, "__esModule", {value:true}) with NO exports.default, so Vite's module-runner throws "'brace-expansion' does not provide an export named 'default'" during astro build config load. 5.0.7 (no __esModule) synthesizes a default and works. Root: @vercel/nft (via @vercel/functions, a website dep) hard-pins glob@^13→minimatch@10→brace 5.x; all require() importers are fine, but Vite's ESM config loader default-imports and breaks. Fix: add pnpm override "glob@>=13.0.0": "10.4.5" to drop the 5.x line; keep brace-expansion 2.x patched at 2.1.3 via existing >=2.1.0 <3 override. Clears #323 without breaking build. See [[019f84f1-4418-7ea9-a9b6-59f20faa0ad9]].