chore(cutover): three root overrides and the recomputed lock clear the advisories objectui's tree brought in (bill item 40, objectstack#25803)

Validate Package Dependencies' base-relative OSV step reads 27 advisories the merged lock
introduces against main's, all from objectui's tree and all with fixes. The three ui manifest
bumps before this commit clear axios, joi, next, zod 3 and postcss-selector-parser 7.1.5. The
rest are transitive, so they take overrides, each listed with its advisories in the comment
block:
- 'body-parser@<1.20.9': '~1.20.9'  (express 4 under @object-ui/cli; body-parser 2 untouched)
- 'markdown-it@>=14.0.0 <14.3.3': '^14.3.3'  (typedoc, @vscode/vsce)
- 'postcss-selector-parser@6.0.10': '7.1.6'  (@tailwindcss/typography 0.5.20's exact pin)

The lock is recomputed on the cutover head, not spliced again: pnpm install --lockfile-only
twice (the second changes nothing), pnpm dedupe, pnpm dedupe --check 0, pnpm install
--frozen-lockfile 0.

Measured:
- pnpm audit: 28 advisories -> 1, the @azure/msal-node one main already has.
- splice-lockfile --measure against objectui 9e1fe03's own lock: moved 44 -> 47, and the
  three new moves are exactly the three manifest bumps.
- one zod copy left (4.6.7); ui check-lockfile-dedupe: deduped; check:override-consistency,
  check-osv-exemptions and check-watch-hint-literal exit 0.
- the console's Tailwind entry (src/index.css, with @tailwindcss/typography) compiles to
  byte-identical CSS on postcss-selector-parser 6.0.10 and 7.1.6.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUXv64KLMfYv3ia2sWi6te

Author: claude