fix(deps): clear fast-uri HIGH advisories with 4.1.4 (ports upstream #136700)

[catomean]

security-fast went red on main immediately after the upstream sync (#6): six fast-uri advisories (four HIGH visible to pnpm audit --prod) were published after our sync point b6306da1a9. Upstream fixed the same thing hours later in 4cedaa057a (#136700); this PR ports the part that applies to our tree instead of hand-writing a divergent fix:

• pnpm-workspace.yaml: override fast-uri 4.1.2 → 4.1.4 + upstream's minimumReleaseAgeExclude cooldown entry (removal date 2026-09-09, upstream's own)
• pnpm-lock.yaml: regenerated with the pinned pnpm 12.0.0. The esbuild@0.28.1 entries drop out because the resolution pass collapses the duplicated esbuild onto 0.28.2 (already present, all platform variants intact)

Not ported (documented, deliberate): upstream's nodemailer scoped overrides (they target mailparser@3.9.15; our tree has 3.9.16 so they would not bind, and our audit reports no nodemailer HIGH) and the vercel-cli release-gate lock refresh (release workflows only, not exercised by this fork's CI). The next upstream sync brings both verbatim.

Local verification with the exact CI command:

node scripts/pre-commit/pnpm-audit-prod.mjs --audit-level=high
→ No high or higher advisories found for production dependencies.

This PR's push run also demonstrates the self-heal of checks-fast-bundled-protocol (its diff base is now the synced tree, not the 3-month-old one).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn

[github-actions]

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

• pnpm-lock.yaml
• pnpm-workspace.yaml

Maintainer follow-up:

• Review whether the dependency changes are intentional.
• Inspect resolved package deltas when lockfiles or workspace dependency policy changes are present.
• Treat pnpm-lock.yaml and package-lock.json diffs as dependency security-review surfaces.
• Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

[github-actions]

Dependency graph changes noted

This PR includes dependency graph changes. The dependency guard is informational because the PR author is a repository admin, a member of @openclaw/openclaw-secops, or an OpenClaw organization member with Maintain or Admin repository access.

• Current SHA: b80b53a23157b94bfc1fa7a03026ad05cae7c232
• Trusted actor: @catomean
• Trusted role: pull request author; repository admin

Security review is still recommended before merge when the dependency graph change is intentional.