ci: Fix Dependabot alerts on transitive npm dependencies.

## Description

Several Dependabot alerts are open for vulnerable transitive npm dependencies (picomatch, lodash, tmp, brace-expansion). These are not direct dependencies but come through commitizen, semantic-release, and micromatch.

## Tasks

- [x] Add npm `overrides` to force patched versions
- [x] Verify `npm audit` reduction
- [x] Verify CI passes

## Related

- PR #279