semgrep-code-getsentry[bot] flags lockfile deps by CVE history, not version range

Trap: semgrep-code-getsentry[bot] posts inline review comments on pnpm-lock.yaml flagging packages (vite, vitest, fast-xml-parser) as High/Critical vulns. Looks like a real fix is needed. Root cause: the bot scans the lockfile for ANY version of a package with a CVE in its history, without checking whether the resolved version falls in the vulnerable range. In craft PR #854 it flagged vite@7.3.5, vitest@4.1.8, fast-xml-parser@5.8.0 — all already patched (confirmed via GHSA vulnerable ranges). Fix: cross-check against Dependabot (range-aware, authoritative for the repo) and verify the resolved version is actually in the vulnerable range before bumping. Bumping patched deps can regress builds (e.g. a vite bump would break docs' astro 7 requirement for vite 8).