fix: bump undici and form-data to patch Dependabot alerts

[riglar]

Summary

Resolves all 8 open Dependabot alerts by bumping two transitive dependencies pinned via the lockfile.

Package	Before	After	Fixes
undici	7.24.4	8.5.0	7 advisories — WebSocket DoS (high), SOCKS5 cross-origin routing (high), TLS cert validation bypass (high), Set-Cookie / cache disclosure (med/low) — needed ≥7.28.0
form-data	4.0.5	4.0.6	CRLF injection via unescaped multipart field names (high)

Changes

• package.json: pnpm.overrides.undici >=7.24.4 → >=7.28.0; form-data ^4.0.5 → ^4.0.6
• pnpm-lock.yaml: regenerated (undici → 8.5.0, form-data → 4.0.6)
• dist/index.js: rebuilt via ncc build

Notes

• undici jumps a major version (7 → 8) since the override permits the latest. It's a transitive dep only (not imported directly by the action), and pnpm run build compiles cleanly.
• Recommend a CI / integration run against the rebuilt dist before release.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}