craft dependency-review: @vercel/client exact pins need pnpm overrides

craft's dependency-review workflow runs fail-on-severity: high with no config file, so any high-severity transitive vuln BLOCKS merges. @vercel/client@18.2.5 and friends exact-pin vulnerable versions with no newer release dropping them: js-yaml@4.1.1 (via @vercel/python-analysis), path-to-regexp@6.1.0 (@vercel/routing-utils@6.4.1, latest — it also carries the fixed one aliased path-to-regexp-updated), tar-fs@1.16.3 (direct, exact pin). Fixes are root pnpm.overrides: js-yaml: ^4.3.0, path-to-regexp@<6.3.0: ^6.3.0, tar-fs@<1.16.4: 1.16.6 (1.16.6 chosen over 2.x to keep tar-stream@1.x; @vercel/client only uses pack, never extract, but CI gates anyway). Root overrides do NOT cascade to docs/ (separate lockfile) — check both. See [[019fa896-e1de-7551-bdb9-bce5ad328264]].