[codex] Override shell-quote audit dependency

[heznpc]

Summary

• add a narrow npm override for shell-quote so the critical audit gate passes
• update package-lock to resolve shell-quote to a patched version
• leave broader Expo/React Native high and moderate findings for a separate major upgrade pass

Verification

• npm ci --ignore-scripts
• npm test -- --runInBand
• npm run lint
• npm audit --audit-level=critical