chore(deps): upgrade high/critical severity dependencies (#514)

Resolve all 10 Critical+High Dependabot alerts:
- smol-toml ^1.3.1 -> ^1.7.1 (runtime, CVE-2026-85730)
- js-yaml override ^3.15.1 -> ^3.15.2 (runtime, CVE-2026-84375)
- vitest / @vitest/coverage-v8 2.x -> 3.2.7 (clears CVE-2026-47429; stays on 3.x)
- override brace-expansion 1.1.18/2.1.4/5.0.9, nanoid 3.3.19, postcss 8.5.28, picomatch 4.0.7

npm audit: critical/high now 0. build + tsc + full vitest suite (3006 tests) pass.

package.json

@@ -56,26 +56,32 @@
     "ora": "^8.1.0",
     "semver": "^7.8.5",
     "simple-git": "^3.36.0",
-    "smol-toml": "^1.3.1",
+    "smol-toml": "^1.7.1",
     "tree-sitter-wasms": "0.1.13",
     "web-tree-sitter": "0.25.10",
     "yaml": "^2.6.0",
     "zod": "^3.24.0"
   },
   "overrides": {
-    "js-yaml": "^3.15.1"
+    "js-yaml": "^3.15.2",
+    "brace-expansion@1": "1.1.18",
+    "brace-expansion@2": "2.1.4",
+    "brace-expansion@5": "5.0.9",
+    "nanoid": "3.3.19",
+    "postcss": "8.5.28",
+    "picomatch": "4.0.7"
   },
   "devDependencies": {
     "@types/cross-spawn": "^6.0.6",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^20.17.0",
     "@types/semver": "^7.8.0",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^3.2.7",
     "opencode-ai": "1.18.23",
     "standard-version": "^9.5.0",
     "tsup": "^8.3.0",
     "typescript": "^5.7.0",
-    "vitest": "^2.1.0"
+    "vitest": "^3.2.7"
   },
   "main": "index.js",
   "directories": {