deps: floor brace-expansion (npm)

[jason-anthropic]

Floor brace-expansion to 1.1.18 (major 1) and 2.1.4 (major 2) via scoped npm overrides in the root package.json (fixes CVE-2026-13149, CVE-2026-14257, CVE-2026-69152).

Registry provenance: this repository's lockfile is public-registry-routed by convention (its own installs fetch from public npm), so the 2 new/changed tarball URL(s) in this PR are spelled on that same public host like the rest of the file. They were resolved through Anthropic's Dependant-gated Artifactory proxy at regeneration time (the environment that regenerated the lock can only resolve through that proxy), and every genuinely new (package, version) was re-verified as servable from the gated route with matching integrity — the public URLs point at byte-identical tarballs. No Artifactory hostname is introduced into this public-convention lock.

Breakage risk: low — brace-expansion is a dev-only transitive on both major lines (pulled in by eslint-plugin-import→minimatch@3 and typescript-eslint→minimatch@9); it is not a shipped runtime dependency, and both moves stay within their own major (1.1.13→1.1.18 patch, 2.0.3→2.1.4 minor), so no consumer is forced across a major and no first-party call site touches the changed surface.

package	floor	manifest
brace-expansion (major 1)	1.1.18	package.json
brace-expansion (major 2)	2.1.4	package.json

Each major is floored with its own overrides key (brace-expansion@1, brace-expansion@2) so neither minimatch consumer is moved across a major. The lockfile regen touched only the two brace-expansion stanzas; new tarball URLs are spelled on registry.npmjs.org to match this lock's existing convention (integrity hashes pin the exact bytes).

Verification:

• npm install --package-lock-only — exit 0; only the two brace-expansion entries changed.
• npm ls brace-expansion --all --package-lock-only — exit 0; both resolve as overridden at 1.1.18 and 2.1.4, no invalid edges.
• npm ci --ignore-scripts — exit 1, pre-existing and unrelated: an unrelated dev dep (eslint-config-prettier@8.10.2) is missing from the gated proxy and fails identically at base. The two brace-expansion floor tarballs were independently confirmed fetchable.
• FOD-hash sweep — no Nix/fixed-output consumers reference the lock.
• No-public-registry diff grep — clean; no internal-host anchors, registry config, scripts, or URLs added.

Notes: build/typecheck/runtime probe could not run because node_modules cannot be materialized while the unrelated frozen-install failure above persists; this change touches only dev transitive version floors.

Residuals (pre-existing, not changed by this PR):

• npm_ci cannot complete on the BASE tree either (npm error 404 Not Found - GET https://artifactory.infra.ant.dev/artifactory/api/npm/npm-all/eslint-config-prettier/-/eslint-config-prettier-) — pre-existing and unrelated to this change; install proof is inconclusive

_{Automated dependency-vulnerability floor (Versant); every verification step above was executed, not inferred.}