fix(deps): resolve 12 Dependabot alerts via pnpm overrides

All 12 open Dependabot alerts are transitive dependencies, so resolve
them with pnpm.overrides (the pattern already used in this repo for
picomatch, brace-expansion, path-to-regexp, lodash).

- shell-quote <1.8.4 -> 1.8.4         (critical, #22; react-devtools)
- undici 7.x <7.28.0 -> 7.28.0        (high/med/low ×6, #30-36; jsdom/vitest)
- form-data <4.0.6 -> 4.0.6           (high, #28; jest-expo)
- js-yaml <3.15.0 -> 3.15.0           (medium, #37; jest istanbul)
- esbuild 0.27.x -> 0.28.1            (low, #23; vite/tsx)
- @opentelemetry/core <2.8.0 -> 2.9.0 (medium, #25; fedify runtime)
- uuid 7.0.3 -> 11.1.1                (medium, #19; xcode/expo prebuild)

Notes:
- undici override is scoped to 7.x so fedify's undici@6.27.0 (not in any
  vulnerable range) is left untouched.
- @opentelemetry/core pinned to 2.9.0 (not the minimum 2.8.0) to dedupe
  with the copy Sentry already pulls in, avoiding an otel version skew.
- uuid pinned narrowly to the vulnerable 7.0.3; xcode calls
  require('uuid').v4(), which still works under v11 (verified).

Verified: pnpm install / build / typecheck / test all pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

package.json

@@ -34,6 +34,13 @@
       "brace-expansion@>=4.0.0 <5.0.5": "5.0.5",
       "path-to-regexp@<0.1.13": "0.1.13",
       "lodash@<4.18.1": "4.18.1",
+      "shell-quote@<1.8.4": "1.8.4",
+      "undici@>=7.0.0 <7.28.0": "7.28.0",
+      "form-data@>=4.0.0 <4.0.6": "4.0.6",
+      "js-yaml@<3.15.0": "3.15.0",
+      "esbuild@>=0.27.3 <0.28.1": "0.28.1",
+      "@opentelemetry/core@<2.8.0": "2.9.0",
+      "uuid@7.0.3": "11.1.1",
       "react": "catalog:",
       "react-dom": "catalog:"
     },