chore(deps): close transitive CVE alerts via pnpm overrides (#1527)

Four open Dependabot alerts, all on transitive npm dependencies, so no
direct dependency changes:

- browserslist 4.28.1 -> 4.28.8 (GHSA-73wf-gq98-2v4g, high)
- @xmldom/xmldom 0.8.13 -> 0.8.15 (GHSA-6gmq-8vp8-gcm6)
- @humanfs/node 0.16.7 -> 0.16.8 (GHSA-p498-v437-472g)
- postcss-selector-parser 6.1.2 -> 6.1.4 (GHSA-w9m9-85wc-3x92)

@xmldom/xmldom already had an override, but its pinned target 0.8.13 had
itself fallen into the widened advisory range (<= 0.8.14), so that entry
is bumped rather than added.

browserslist is pinned to 4.28.8 rather than the advisory's 4.28.7 because
4.28.8 was already resolved elsewhere in the tree; collapsing onto it takes
browserslist from three copies to one and drops the duplicate
caniuse-lite/electron-to-chromium/update-browserslist-db trees with it, so
the lockfile is a net reduction. postcss-selector-parser 6.0.10 is left
alone: it sits below the advisory's >= 6.1.0 lower bound.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

.changes/deps-transitive-cve-overrides.md

@@ -0,0 +1,10 @@
+---
+type: internal
+area: deps
+---
+
+Closes the four open Dependabot alerts on transitive npm dependencies via
+pinned pnpm overrides: browserslist (crash on untrusted stats), @xmldom/xmldom
+(XML fragment injection — its existing override target had itself fallen into
+the advisory range), @humanfs/node (recursive copy follows symlinks out of the
+tree) and postcss-selector-parser (AST recursion DoS).