fix(deps): bump astro to 7.1.3 + re-resolve brace-expansion to clear osv-scanner (#636) (#637)

The osv-scanner required check (`Secrets, deps, and workflow scan`) fails on main's
yarn.lock, ejecting every PR from the merge queue (observed on #623). Advisories were
published after PR-open scans, so PR-level checks are green while the merge_group
re-scan is red.

- astro 7.0.5 -> 7.1.3 (docs/package.json). Fixes GHSA-4g3v-8h47-v7g6 (XSS),
  GHSA-8mv7-9c27-98vc, GHSA-f48w-9m4c-m7f5. NOTE: intentionally 7.1.3, NOT 7.1.0 —
  7.1.0 (the version Dependabot #631/#630 target, and the "fixed" version GHSA-4g3v
  cites) is flagged malicious by MAL-2026-10726. 7.1.3 is the current `latest` and is
  past the single poisoned release.
- brace-expansion re-resolved within existing ^1.1.7/^2.0.2 ranges: 1.1.15 -> 1.1.16
  and 2.1.1 -> 2.1.2 (GHSA-3jxr-9vmj-r5cp). Transitive-only; no resolutions pin needed.

Lockfile-only (+ one version string). Verified: `mise run security:deps` exits 0,
`mise //docs:build` builds 68 pages clean, `mise run security:retire` clean.
Supersedes Dependabot #631/#630 (which bump to the malicious 7.1.0).

Co-authored-by: bgagent <bgagent@noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people