security(deps): today's browserslist high advisories fail the audit step repo-wide

[ophiocus]

What's happening

Since ~18:00Z today, the pnpm audit --prod --audit-level high step inside scripts/verify.mjs fails on every run of the verify job, on every branch — regardless of the change under test. Two high-severity advisories against browserslist were published today:

• GHSA-c83g-rgw3-j3cx (high)
• GHSA-73wf-gq98-2v4g (high)

Both cover browserslist <= 4.28.6. The lockfile currently resolves 4.28.6, reached transitively through the Docusaurus/Babel chain (apps/docs > @docusaurus/core > @docusaurus/babel > @babel/core > browserslist — ~100 dependency paths).

Evidence

First seen on #245's merged-head run (33541839077):

4 vulnerabilities found
Severity: 4 high (2 ignored)
✖ audit failed

verify-windows and minimum-node pass on the same head — only the audit step is red. Any open PR that pushes now inherits the same failure, so the whole review queue goes red through no fault of its authors.

Impact

• CI: repo-wide verify failure; effectively blocks merging until floored.
• Runtime: low for this repo — browserslist here is a build-time dependency of the docs site's Babel toolchain, not a production code path of the gateway/API. The urgency is the CI outage, not an exploitable surface.

Fix

One-line dependency floor in the existing pnpm-workspace.yaml overrides pattern (same shape as the nanoid floor already there):

"browserslist@<4.28.7": 4.28.7

Lockfile then resolves the patched 4.28.7; local pnpm verify audit step comes back clean. PR incoming from this branch: fix/browserslist-audit-floor.

cc @adrian-lorenzo — flagging since this makes every open PR's verify red today, including several currently in your review queue; the floor unblocks all of them at once.