fix(deploy): pin transitive deps to pass supply-chain min-release-age

[TusharW4ni]

Problem

After the OIDC fix, the prod deploy got past AWS auth but failed at the Docker build:

[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 2 lockfile entries failed verification:
  baseline-browser-mapping@2.11.18  (published <24h before the build)
  seroval@1.6.3                     (published <24h before the build)

The deploy's pnpm enforces a 24h supply-chain minimum-release-age policy. These two transitive deps had brand-new releases locked into the lockfile. (Local pnpm 10.28.1 doesn't enforce this policy, so it silently locked the too-new versions.)

Fix

Pin the two packages to their latest versions that pass the 24h policy, via pnpm.overrides in pnpm-workspace.yaml:

• baseline-browser-mapping → 2.11.17 (2026-08-21)
• seroval → 1.6.2 (2026-08-04)

Both are one patch below the flagged versions. Safe to bump/remove once newer releases age past 24h.

Verification

• ✅ Latest pnpm (v11, matches the deploy): Lockfile passes supply-chain policies
• ✅ pnpm build and pnpm test green
• Diff is only pnpm-workspace.yaml + pnpm-lock.yaml

Follow-up (not in this PR)

Root cause is that locally-generated lockfiles can slip in too-new packages because local pnpm doesn't enforce the policy. Durable prevention = pin a policy-aware pnpm via packageManager (or add minimumReleaseAge once contributors are on a pnpm that honors it), so local + CI stay consistent.

🤖 Generated with Claude Code