fix(*): mitigate glob parsing and update vulnerable dependencies

[omermorad]

Summary

Mitigate the reachable glob-parsing stack-exhaustion path identified in the separate risk review for GHSA-vfj7-8cjw-p6xm.

• Check the exact resolved pattern before calling fast-glob: maximum length 1,024 JavaScript string code units and maximum brace/parenthesis nesting 32.
• Use a bounded, non-recursive scan that respects escapes, quotes, character classes, and matching delimiters.
• Reject excessive patterns with a clear ConfigError without logging the supplied pattern. Literal paths and ordinary glob matching retain their existing behavior.
• Add 19 regression cases to the existing configuration E2E suite, covering the reproduced input, boundary limits, quoted/escaped/class closers, mixed nesting, normal matches, and literal paths. No new test files or test infrastructure.
• Include the dependency overrides and lockfile updates from fix(*): align beta workflows and update vulnerable dependencies #31. The live audit now reports only the two reviewed advisories below, instead of the 23 findings on the original branch.
• Keep audit handling inline in the existing GitHub Actions workflow. No scripts folder, custom action, or additional workflow is introduced.

Verification

• pnpm build: passed.
• pnpm lint: passed.
• pnpm test: 8 passed.
• pnpm test:e2e: 358 passed, 1 existing skip.
• git diff --check: passed.
• Workflow linting: passed. Existing Node 22/24/26 matrix unchanged.
• Live audit gate: passed with the two explicitly accepted risks, not a clean vulnerability report.
• Clean-worktree audit: passed after a frozen, scripts-disabled install. This install is required because pnpm returns empty dependency paths without node_modules; the gate deliberately rejects incomplete paths.
• 17 ephemeral gate probes passed: expiry boundaries, clean reports after expiry, additional low-severity findings, registry/malformed-report errors, unexpected statuses, muted findings, changed advisory IDs/packages/versions, unreviewed cache paths, and inconsistent metadata. No repository test files were added for these probes.

Scope and remaining risk

• Targets next. Security changes are also integrated into fix(*): align beta workflows and update vulnerable dependencies #31 without rewriting either branch's existing commits. Review this security PR first; fix(*): align beta workflows and update vulnerable dependencies #31 retains the separate beta-workflow changes.
• Changes the CLI config loader, its existing E2E suite, dependency overrides/lockfile, and existing dependency-audit workflow. No package release versions, CI matrix, rulesets, or release workflows change here.
• This addresses the reported recursive glob-input path, not every possible glob-complexity denial of service or every transitive braces consumer.
• Omer approved two temporary CI risk exceptions on 2026-10-08. They expire at 2026-10-22 05:37:00 UTC, with no automatic extension:
  • braces / GHSA-vfj7-8cjw-p6xm, only version 3.0.3. CLI glob guards mitigate the reviewed input path; other tooling consumers remain affected.
  • http-cache-semantics / GHSA-ch52-4w7c-c8xp, only version 4.2.0 through the reviewed root Lerna 9.0.7 paths. Reviewed callers use private caches on fresh runners; this is not approval for shared-cache usage.
• Every other advisory remains blocking, regardless of severity. Registry/schema errors fail closed. At expiry, either remaining advisory blocks again; a clean audit still passes. Warnings and the job summary make accepted risk visible. Remove these exceptions when patched; no security alert is dismissed.
• The Action still bundles the published CLI. It receives this mitigation only after a separately approved Contractual publication followed by an Action dependency/bundle update. No SHA substitution or release is performed here.
• These exceptions apply to CI only. The publishing audit in fix(*): align beta workflows and update vulnerable dependencies #31 remains strict; any publishing-gate exception needs separate approval. No approval to merge, create/move tags, publish packages, or create GitHub Releases is implied or exercised.