fix: picomatch vulnerability

[Gustavo-Cauzzi]

Summary

Patches GHSA-jr5w-wmq9-7g6c (picomatch <4.0.4). Dependabot can't fix it on its own because the vulnerable copy is bundled inside the npm CLI tarball (pulled in via semantic-release → @semantic-release/npm). Adds two overrides in package.json:

• npm: ">=11.14.1 <12.0.0" — bundled npm tarball that ships picomatch@4.0.4 internally
• picomatch: ">=4.0.4 <5.0.0" — covers the non-bundled copies elsewhere in the tree

Both are dev-tooling only — picomatch is not in the published SDK bundle (verified: zero references in src/).

Verified

• npm ci clean
• npm run format:check, npx tsc, npm run build clean
• Cypress green in CI (run against the built static/cdn.js)
• npm audit no longer reports the picomatch advisory

After merge

• Dependabot alert should auto-close
• The existing failing Dependabot PR can be closed manually (it has no path to fix this on its own)

[beelol]

Can we test in staging