fix(deps): force shell-quote >=1.8.4 to resolve CVE-2026-9277 (Dependabot #128)

shell-quote <=1.8.3 fails to escape line terminators in object-token
.op values, allowing shell command injection (GHSA-w7jw-789q-3m8p,
critical). It reaches us only as a transitive devDependency via
concurrently@9.2.1, which pins shell-quote to exactly 1.8.3 — and
concurrently 10.x (which ships 1.8.4) requires Node >=22 while this
repo supports Node >=20, so a pnpm override is the minimal fix.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

package.json

@@ -107,6 +107,7 @@
       "@types/react-dom": "19.2.3",
       "dompurify": "^3.4.5",
       "qs@<6.15.2": "^6.15.2",
+      "shell-quote@<1.8.4": "^1.8.4",
       "tmp@<0.2.6": "^0.2.6",
       "uuid@<11.1.1": "^11.1.1"
     }