fix(deps): remediate 9 Dependabot alerts via pnpm.overrides

[fro-bot]

Summary

Adds pnpm.overrides entries to pin transitive minimatch and rollup dependencies to patched versions, resolving all 9 open high-severity Dependabot alerts.

Dependabot Alerts Resolved

Alert(s)	Package	Vulnerability	Before	After
#18, #22, #25	minimatch 3.x	ReDoS	3.1.2	3.1.5
#17, #21, #24	minimatch 9.x	ReDoS	9.0.5	9.0.9
#20, #23	minimatch 10.x	ReDoS	10.2.2	10.2.3
#19	rollup 4.x	Arbitrary File Write via Path Traversal	4.55.1	4.59.0

Changes

package.json — Added overrides targeting each affected dependency tree:

• @actions/glob>minimatch: 3.1.2 → 3.1.5 (alerts feat: implement RFC-003 GitHub API client infrastructure #18, feat(github): add GitHub App client #22, feat(setup): implement RFC-011 setup action with OpenCode installation #25)
• @typescript-eslint/typescript-estree>minimatch: 9.0.5 → 9.0.9 (alerts feat(cache): implement RFC-002 cache infrastructure #17, fix(cache): prevent auth.json deletion outside storage path #21, docs(ai): update project knowledge base with recent changes #24)
• @npmcli/arborist, @npmcli/map-workspaces, @tufjs/models, eslint-plugin-import-x, eslint-plugin-json-schema-validator, eslint, glob, ignore-walk >minimatch: 10.2.2 → 10.2.3 (alerts docs(agents): update knowledge base with RFC implementation status #20, docs: clarify action-side vs agent-side session management #23)
• vite>rollup: 4.55.1 → 4.59.0 (alert fix(deps): update dependency @actions/cache to v5 #19)

src/main.test.ts — Increased timeout for the integration test that spawns a subprocess (dist/main.js). The test takes ~4.6s in isolation but could exceed the 5000ms default timeout under load when all 65 test files run concurrently.

Verification

• All 969 tests pass ✅
• pnpm build succeeds ✅
• Vulnerable versions removed from pnpm-lock.yaml ✅

Scope

• No source code changes
• No breaking changes
• Purely additive override entries following existing pattern (e.g. @eslint/config-array>minimatch)