fix(site): patch build-toolchain advisories in the website lockfile

[johnny4young]

Summary

Reconcile the website dependency refresh in #252 with the build-toolchain security fixes in this PR. Only site/package.json, site/package-lock.json, and the existing CHANGELOG entry differ from main.

• Preserve Sharp 0.35.5 in both the direct dependency and override, including its platform packages.
• Preserve chore(deps-dev): bump the site-dependencies group in /site with 2 updates #252's Wrangler 4.147.0 update and its matching workerd/miniflare dependency changes.
• Override http-cache-semantics to 4.3.0 and source-map-js to 1.2.2; retain the existing nanoid and undici overrides.
• Regenerate the lockfile with npm 11.21.0, preserving all 34 libc selectors. The cloud's older npm 11.9.0 also removed those selectors, so that output was discarded. Use the verified npm version for future regeneration.

These are website build/deployment-tool dependencies. No Swift source, app entitlements, runtime networking, website source, workflow, or deployment configuration changed.

Integration and review order

1. Review and merge chore(deps-dev): bump the site-dependencies group in /site with 2 updates #252 first at 720dbd43a10d3d85bac4eababdf4dcafbad28008.
2. Review and merge this PR second.

Merge-method condition: the conflict-free proof assumes #252 is merged with its existing commit ancestry preserved (a merge commit). A local simulation of squash-merging #252 still produces a package.json context conflict because its new commit is not an ancestor of this branch. If choosing squash/rebase instead, refresh this PR against the resulting main and rerun the lockfile/site checks before merging it; do not resolve by discarding either side.

The reconciliation commit 68b31d6f98b2f447d9839c9e09ef28715875d652 has two parents: this PR's original a1ce34d9775c95d90dff211f9a5fcbbaa82de22c and #252's 720dbd43a10d3d85bac4eababdf4dcafbad28008. Existing commits and both PR bases are preserved. This feature-branch integration resolves overlapping package.json context as well as lockfile content; neither PR nor main has been merged.

Against #252, the entire remaining diff is:

• Two override entries in package.json.
• Version/resolved/integrity changes for exactly two lock entries: http-cache-semantics and source-map-js.
• The three-line security changelog entry.

A local git merge-tree --write-tree of #252 with the reconciled head completes without conflicts and produces the exact tested tree. This order also avoids obscuring #252's review by merging its descendant first. If either source branch or main changes, recheck the integration rather than selecting one lockfile wholesale.

Verification

Exact tested tree: f3f94695fbfdd449f194dc3020f7a858414d7ae4
Published head: 68b31d6f98b2f447d9839c9e09ef28715875d652

Local Linux checks on Node 22.22.0 / npm 11.21.0:

• Clean npm ci --no-audit --no-fund: passed.
• npm test: passed image generation, Astro check (0 errors, 0 warnings), static build, build validation, and 58/58 tests.
• npm audit --json: 0 vulnerabilities at verification time.
• All 34 platform libc selectors match chore(deps-dev): bump the site-dependencies group in /site with 2 updates #252 exactly.
• git diff --check, repository hygiene, and changelog/version checks: passed.
• All portable prerequisites of make lint: passed; its QA archive sub-check explicitly skips where ditto/unzip is unavailable.

Local limitations:

• make format and the final Swift-format stage of make lint cannot run on this Linux host because xcrun/Xcode are absent. No Swift files changed.
• Native checks were not run locally; the new exact-head CI run below validates them on the macOS runners.
• Astro initially tried an unwritable default config directory. The successful run used a writable XDG_CONFIG_HOME with ASTRO_TELEMETRY_DISABLED=1; no tracked files were changed for this.
• Audit is a time-sensitive registry snapshot, not a claim that these dependencies can never receive advisories.
• No release, deployment, merge, or auto-merge was performed.

Reviewer focus

Verify the two-parent ancestry and narrow diff against #252; confirm Sharp/Wrangler pins and all overrides agree with the lockfile; retain the libc platform metadata; inspect the latest CI for the published head before merging.

Final CI result

CI run 37551495048 completed successfully for head 68b31d6f98b2f447d9839c9e09ef28715875d652: 5/5 jobs green (Linux static checks; build/test on Sequoia 15 and Tahoe 26; UI tests on both versions). The native lanes include Swift-format, Debug/universal Release builds, coverage tests, performance and golden gates; both UI lanes include the strict visual evidence tour.

GitHub's test merge d810b25ea24a1ad8674a06b0de32450692046e40 has tree f3f94695fbfdd449f194dc3020f7a858414d7ae4, identical to the local tested and published tree. Linux CI independently reports 58/58 site tests, 0 Astro errors/warnings, and 0 audit findings. This is ready for the requested subsequent human/model review, not an approval to merge.