fix: update vulnerable npm dependencies

[palvimaki]

Summary

• update PostCSS and Vite to fixed releases
• update vulnerable transitive resolutions in package-lock.json
• override the PWA asset-generator sharp path to 0.35.0
• add PR CI for clean install, package metadata validation, high-severity audit, local PWA assets, and production build
• pin actions/checkout to 3d3c42e5aac5ba805825da76410c181273ba90b1 (v7.0.1)
• pin actions/setup-node to 820762786026740c76f36085b0efc47a31fe5020 (v7.0.0)
• run PR CI on pushes to main; this repository has no deployment workflow or hook

Executed verification

• Ruby parsed .github/workflows/pr-ci.yml successfully
• DUDEOPS_NPM_ALLOW_INSTALL=1 npm ci passed: 476 packages installed; 0 vulnerabilities
• node scripts/check-package-metadata.mjs passed: colibrious@0.0.0 matches package.json, the lockfile header, and packages[""]
• npm audit --audit-level=high reported 0 vulnerabilities
• ./node_modules/.bin/pwa-assets-generator --preset minimal-2023 assets/logo.png passed without npx or registry fallback
• npm run build passed
• npm run lint passed
• git diff --check passed
• GitHub Actions PR CI passed on commit 076dbfe71096ae816e911121f014bf57744b35bb
• This project has no npm test script

Lockfile result

• package.json, the package-lock.json header, and package-lock.json root package all name the project colibrious
• All three files use version 0.0.0
• npm 10.9.8 accepts the sharp override during clean install
• npm 10.9.8 does not write root overrides metadata into this lockfile format

Resolved advisory IDs

GHSA-4x5r-pxfx-6jf8, GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895, GHSA-v2hh-gcrm-f6hx, GHSA-7p8r-x3mc-p8w7, GHSA-4c8g-83qw-93j6, GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849, GHSA-f88m-g3jw-g9cj, GHSA-v6wh-96g9-6wx3, GHSA-fx2h-pf6j-xcff