pnpm security override remediation

Use package.json pnpm overrides for vulnerable transitive dependencies, then regenerate pnpm-lock.yaml and verify with check:deps, check:patches, focused tests, typecheck, and lint. Current security overrides include patched js-yaml 3.x/4.x, nanoid, and ip-address; overrides are preferred over unrelated direct dependency changes because the vulnerable packages are transitive.