chore: audit and patch security vulnerabilities across deps

[djfarrelly]

Resolves the bulk of pnpm audit findings (was 70 vulns: 1 critical, 21
high, 37 moderate, 11 low) by bumping direct deps to patched versions
and adding pnpm.overrides for transitive packages with known
advisories.

Workspace (packages/workflow + root):

• Bump inngest to ^3.54.2 (fixes GHSA env-var disclosure in serve()
  handler, vulnerable <3.54.0)
• Bump @storybook/* addons to ^8.6.18 (align with storybook version,
  unblocks vite 6 upgrade)
• Bump @changesets/cli to ^2.31.0 (drops vulnerable cross-spawn/tmp)
• Bump typescript to ^5.9.3 (satisfies inngest peer)
• Add vite ^6.4.2 and zod ^3.25.76 as direct devDeps to pin
  patched versions for storybook + inngest peer chains
• Add pnpm.overrides for transitive vulns: next, esbuild, cookie,
  path-to-regexp, qs, cross-spawn, tmp, minimatch, brace-expansion,
  picomatch, @babel/runtime, @babel/helpers, postcss, ws, uuid
• Remaining: 3 lodash advisories (no patched version published; only
  reachable via @testing-library/jest-dom devDep tree, no runtime impact)

examples/nextjs-blog-cms:

• Complete the next@16 migration from the previous "Update deps"
  commit: regenerate lockfile (was stale at next@14.2.11) and update
  call sites for Next 15+ async APIs (cookies(), dynamic-route
  params)
• Bump next to ^16.2.6 and eslint-config-next to ^16.2.6 (closes
  all remaining next CVEs in 16.x line)
• Pin @supabase/supabase-js to ~2.45.4 (newer minor versions
  changed the Database type structure incompatibly with the hand-curated
  lib/supabase/types.ts)
• Add @xyflow/react ^12.1.1 as direct dep (Turbopack does not
  resolve subdeps the same way webpack did, and the example imports
  the package's CSS directly)
• Switch eslint to flat config + bump to ^9 (eslint-config-next 16
  requires eslint >=9)
• Add pnpm.overrides for postcss, underscore, @supabase/auth-js
• Replace next lint script with direct eslint . (next lint was
  removed in next@16)

[changeset-bot]

🦋 Changeset detected

Latest commit: 4a36a3e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@inngest/workflow-kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR