fix(deps): bump astro (7.1.0) + brace-expansion to clear osv-scanner failures blocking the merge queue

[scottschreckengaust]

Summary

osv-scanner (required check Secrets, deps, and workflow scan → Dependency scan (osv-scanner))
fails on main's yarn.lock, which blocks the merge queue for every PR — the merge_group
re-scan runs against the latest main and ejects any queued PR (observed on #623, which is otherwise
CLEAN and approved).

These advisories were published after the affected PRs were last scanned at PR-open time, so the
PR-level checks are green while the merge_group re-scan is red.

Affected packages (from the failing run)

osv-scanner scan --lockfile agent/uv.lock --lockfile yarn.lock — 3 packages, 5 known vulns (2 High, 3 Medium):

OSV	CVSS	Ecosystem	Package	Version	Fixed
GHSA-3jxr-9vmj-r5cp	7.7	npm	brace-expansion	1.1.15	1.1.16
GHSA-3jxr-9vmj-r5cp	7.7	npm	brace-expansion	2.1.1	2.1.2
GHSA-4g3v-8h47-v7g6	5.3	npm	astro	7.0.5	7.1.0
GHSA-8mv7-9c27-98vc	5.1	npm	astro	7.0.5	7.0.6
GHSA-f48w-9m4c-m7f5	5.1	npm	astro	7.0.5	7.0.6

Fix

Bump both in the root yarn.lock (and docs/ for astro):

• astro → 7.1.0 (root + /docs). Already proposed by Dependabot chore(deps): npm: bump astro from 7.0.5 to 7.1.0 #631 (root) and chore(deps): npm: bump astro from 7.0.5 to 7.1.0 in /docs #630
  (/docs) — this consolidated fix supersedes them; close those as superseded once this lands.
• brace-expansion (transitive, both majors) → 1.1.16 / 2.1.2, via yarn up brace-expansion
  or a resolutions entry.

Then mise run security:deps must exit 0.

Acceptance criteria

• mise run security:deps (osv-scanner) exits 0 on the branch.
• astro at 7.1.0 in root yarn.lock and docs/ lockfile; brace-expansion at 1.1.16/2.1.2.
• No functional/source changes — lockfile (+ optional resolutions) only.
• Dependabot chore(deps): npm: bump astro from 7.0.5 to 7.1.0 #631 / chore(deps): npm: bump astro from 7.0.5 to 7.1.0 in /docs #630 closed as superseded (or explicitly kept, one or the other).

Context

Surfaced while merging #623 (the queue kept ejecting it). Blocks all merges to main.

[scottschreckengaust]

Starting implementation — this blocks the merge queue for all PRs (observed on #623). Fix is lockfile-only.