P0: remediate production dependency advisories blocking Gate C #102

Type: Dynamic Security Bug
Priority: P0
Found by: #54 at main 6d3eb1e
Blocks: Gate C and release candidate
Writable: package.json, apps/web/package.json, pnpm-lock.yaml, pnpm-workspace.yaml, dependency audit tests/docs only

Observed failure

ASDF_NODEJS_VERSION=22.23.1 pnpm audit --prod --audit-level=moderate exits 1 with 6 production advisories: 2 moderate and 4 high. Affected installed packages are sharp 0.34.5, postcss 8.4.31, and nanoid 3.3.16. Patched floors reported by the audit are sharp 0.35.0, postcss 8.5.23, and nanoid 3.3.17.

Acceptance

• production audit at moderate threshold exits 0
• no critical, high, or moderate production advisory remains
• direct and transitive package resolution uses maintained compatible versions
• lockfile and sharp build allowlist are deterministic and exact
• no unrelated framework, product, evidence, Clear402, or Moss boundary change
• full pnpm check passes
• Clear402 false and true builds, integration suites, and browser E2E pass
• production start and public health/demo smoke pass after merge

Do not suppress, ignore, or reclassify an advisory to pass the gate. Keep the dependency diff minimal.