chore: refresh transitive security locks

[0thernet]

Summary

• regenerate the Bun and pnpm lock graphs from the unchanged manifest
• remove stale vulnerable and duplicate transitive resolutions
• align both lockfiles on current nanoid, PostCSS, and tar security fixes

Verification

• Bun 1.3.14 frozen install
• pnpm 10.12.1 frozen lockfile install
• Bun and pnpm audits: zero advisories
• graph reachability/integrity audit: no missing or unreachable entries
• bun run test:types
• bun run test:package
• bun test test/store.test.ts (259/259)

The GPU-heavy native suite is left to current-head CI because repeated local runs exhausted the Metal command queue; no source or manifest files changed.