[SandObserver]

Summary

• Add npm overrides for minimatch (^11.0.3) and glob (^14.0.3). Both reach the repo only through c8 and test-exclude@8.0.0, which still ask for minimatch 10 and glob 13.
• Clears GHSA-g3hv-75wg-m249 (minimatch globparts amplification) and GHSA-3g3m-2fjr-6pw4 (glob AbortSignal bypass). npm audit reports 0 vulnerabilities.
• Development dependencies only. The image is unchanged: it installs no npm packages and the API has no runtime dependencies.

Testing
All green, including the Docker build and image scan. Backend coverage stays at 97.28% of lines.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.