fix(ci): clear the 2 HIGH browserslist advisories blocking the image build

The `shared` job's trivy fs scan started failing on CVE-2026-73088 and
CVE-2026-73089 (browserslist 4.28.2, prototype pollution + unbounded DoS,
both fixed in 4.28.7). Because `image` is gated on `shared`, no image was
built and the portal entitlement fix could not deploy.

Not introduced by any code change: `shared` passed on the previous commit
(ac28e22) with the same dependency tree. Trivy refreshes its vulnerability DB
each run, so these advisories were published in between.

Cleared with a pnpm override, the same pattern already used here for nanoid,
postcss, @auth/core and sharp. browserslist is transitive (not a declared
dependency), so an override is the only lever. Lockfile now resolves 4.28.8.

Verified: tsc --noEmit 0, next build 0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD

package.json

@@ -54,7 +54,8 @@
       "nanoid@<3.3.18": ">=3.3.18",
       "postcss@<8.5.18": ">=8.5.18",
       "@auth/core@<0.41.3": ">=0.41.3",
-      "sharp@<0.35.0": ">=0.35.0"
+      "sharp@<0.35.0": ">=0.35.0",
+      "browserslist@<4.28.7": ">=4.28.7"
     }
   }
 }