fix: upgrade brace-expansion to 5.0.5 (CVE-2026-33750) (#1132)

Zero-step sequence causes process hang and memory exhaustion.

Author: jdalton

pnpm-lock.yaml

@@ -60,7 +60,7 @@ catalog:
   aggregate-error: npm:@socketregistry/aggregate-error@^1.0.15
   ajv-dist: 8.17.1
   ansi-regex: 6.2.2
-  brace-expansion: 2.0.2
+  brace-expansion: 5.0.5
   browserslist: 4.25.4
   chalk-table: 1.0.2
   cmd-shim: 7.0.0