fix(ci): clear two moderate npm audit advisories

[simonrosenberg]

Summary

The security CI job (which runs npm audit --audit-level=moderate) has been failing on main for several PRs because two transitive advisories landed since the last green run:

1. brace-expansion 5.0.2 - 5.0.5 — GHSA-jxxr-4gwj-5jf2 (moderate; DoS via large numeric range that defeats the documented max protection). Reaches us via eslint → minimatch@^10 → brace-expansion. Fix: nest a brace-expansion: ^5.0.6 override under the existing eslint.minimatch entry, so the pin only applies to the minimatch instance pulled in by eslint and leaves unrelated brace-expansion instances elsewhere in the tree (e.g. glob, test-exclude) alone.
2. ws 8.0.0 - 8.20.0 — GHSA-58qx-3vcg-4xpx (moderate; uninitialized-memory disclosure). ws is a direct dependency at ^8.20.0; npm audit fix walks it forward to 8.20.1 inside the same major. No package.json change needed beyond the lockfile bump.

After these changes, npm audit reports 0 vulnerabilities. CI's security job should go green again.

Diff

 package-lock.json | 32 ++++++++++++++++----------------
 package.json      |  5 ++++-
 2 files changed, 20 insertions(+), 17 deletions(-)

Test plan

• npm install clean
• npm audit --audit-level=moderate — 0 vulnerabilities
• npm audit --audit-level=high --production — 0 vulnerabilities
• npm run build succeeds
• npm test — 199/199 passing
• npm run lint — clean (warnings pre-existing)
• npm run format:check — clean
• CI: security, test (20.x), test (22.x), build, integration-test, smoke-test, validate-acp-providers all pass

Scope notes

This PR is intentionally minimal — just the override + the lockfile bump from npm audit fix. The earlier merged PR #173 deliberately excluded these changes per maintainer request to keep that PR's diff scoped to ACP work; this is the follow-up that picks them up cleanly on top of main.

🤖 Generated with Claude Code