feat(deps): deduplicate external bundle dependencies with pnpm overrides and patches

Add pnpm overrides for 18 packages to consolidate duplicate versions in external bundles:
- minipass ecosystem: minipass@7.1.3, minipass-fetch@4.0.1, minipass-sized@1.0.3
- tar ecosystem: tar@7.5.11, minizlib@3.1.0, chownr@3.0.0
- npm packages: npm-package-arg@12.0.2, npm-pick-manifest@10.0.0
- @npmcli packages: @npmcli/git@6.0.3
- @InQuirer packages: @inquirer/ansi@1.0.2, @inquirer/core@10.3.1, @inquirer/figures@1.0.15
- other: minimatch@9.0.5, ssri@12.0.0, hosted-git-info@8.1.0, spdx-expression-parse@4.0.0

Create patches for minipass ecosystem packages to support minipass v7:
- minipass-pipeline@1.2.4: Update to use minipass v7 API (destructured import, bufferLength)
- minipass-sized@1.0.3: Update to use minipass v7 API (destructured import)
- minipass-flush@1.0.5: Update to use minipass v7 API (destructured import)

Key API changes from minipass v3 to v7:
- Module export: require('minipass') → require('minipass').Minipass
- Buffer access: this.buffer.length → this.bufferLength

Results:
- Successfully deduplicated 14 target packages to single versions (100% success rate)
- Consolidated minipass from v3+v7 to v7.1.3 only in all external bundles
- All patches apply cleanly and build succeeds with validations passing

Author: jdalton