chore(deps): clear the vulnerable dependency tree and drop the overrides

The overrides block never reached anyone installing the CLI - copy-assets
deletes it from the published manifest - so it protected this checkout and
nothing else. Two of its six entries named packages that are not in the tree
at all, three were obsolete, and the uuid entry actively pinned the whole
tree down to a version the advisory covers. Fix the versions directly
instead: jimp, lodash and uuid clear their own advisories, ts-morph 28 takes
minimatch ^10 as a declared range rather than a semver-violating override,
and sinon 22 clears the last dev-side one.

universal-analytics goes with the GA4 migration, and with it the only
bundleDependencies entry and the node_modules trees copy-assets mirrored
into dist for it.

Refreshing the lockfile clears eight further advisories - sigstore, its two
helpers, xmldom, flatted, form-data, ip-address and picomatch - that were
stale pins rather than outdated ranges. No lockfile ships, so these only
ever affected development and CI.

dotenv loads .env for the release scripts, and .gitignore keeps .env and the
local Claude worktrees out of the repository.

Author: edusperoni

.env.example

@@ -0,0 +1,33 @@
+# Environment used to build and release the CLI.
+#
+# Copy to .env and fill in what you need; .env is gitignored, .env.example is not.
+# The build scripts load .env automatically, but a value already exported in the
+# environment always wins - CI secrets are never shadowed by a stray local file.
+
+
+# --- Analytics -------------------------------------------------------------
+# Measurement Protocol api secret, paired with the measurement id in
+# scripts/set-ga-id.js. Create one under
+#   GA4 Admin -> Data Streams -> <stream> -> Measurement Protocol API secrets
+#
+# Deliberately not committed: this repository is public, so a committed secret
+# would make every contributor's `npm run pack.release` report into the
+# production property. Leave it unset locally - builds then report nothing.
+#
+# Set as the GA_API_SECRET repository secret for releases.
+GA_API_SECRET=
+
+# Same, for the dev measurement id. Unused until a dev id is set in
+# scripts/set-ga-id.js.
+GA_API_SECRET_DEV=
+
+
+# --- Publishing ------------------------------------------------------------
+# Only needed when the USE_NPM_TOKEN repository variable is "true". The default
+# path is OIDC trusted publishing, which needs no token at all.
+NPM_PUBLISH_TOKEN=
+
+# Used by the OpenSSF Scorecard workflow to read branch protection rules.
+SCORECARD_TOKEN=
+
+# GITHUB_TOKEN is provided by Actions automatically and never needs setting here.

.gitignore

@@ -92,3 +92,13 @@ config/test-deps-versions-generated.json
 
 # build output
 /dist
+
+# local secrets, filled in from .env.example
+.env
+.env.*
+!.env.example
+
+# Claude Code local state - worktrees and per-user settings. Ignoring the
+# contents rather than the directory keeps shared settings.json committable.
+.claude/*
+!.claude/settings.json