fix(agentex-ui): bump tar 7.5.20 -> 7.5.22 (GHSA-r292-9mhp-454m) (#382)

## Summary

Remediates **GHSA-r292-9mhp-454m** (MEDIUM) in `tar` for the
`agentex-ui` service.

- **Package:** `tar` (node-pkg)
- **Before:** 7.5.20 (vulnerable)
- **After:** 7.5.22 (>= fixed version 7.5.21)
- **Advisory:** node-tar uncontrolled recursion in
`mapHas`/`filesFilter` allows an uncatchable stack-overflow DoS via a
crafted long-path tar with member selection.

## Change

`tar` is a **transitive** dependency (pulled in by
`@tailwindcss/oxide@4.1.11`, which requires `tar ^7.4.3`) and is
force-pinned via the root `overrides` block. This PR:

1. Raises the `overrides.tar` floor from `^7.5.16` to `^7.5.21` in
`agentex-ui/package.json` so a future re-lock can never float back below
the fix.
2. Re-locks `agentex-ui/package-lock.json` (lockfile-only), resolving
`tar` to **7.5.22** (latest patch satisfying the new floor).

This is a same-minor (7.5.x) patch bump with **no dependency-contract
change**; `@tailwindcss/oxide@4.1.11` supports the 7.5.x line, so the
transitive pin is safe.

## Verification

- `npm ci --dry-run` succeeds — lockfile is in sync with `package.json`
(CI `npm ci` gate passes).
- Version gate: tar 7.5.21 and 7.5.22 both have zero known advisories
(OSV).
- Diff scope: only `overrides.tar` and the single `node_modules/tar`
lockfile entry changed; no transitive-closure churn, no registry flips
(public npm preserved), no app-code changes.
- Old `tar-7.5.20.tgz` is fully removed from the lockfile.

## CVEs closed

- GHSA-r292-9mhp-454m

Resolves
[GFDVR-20835](https://linear.app/scale-epd/issue/GFDVR-20835/trivy-ghsa-r292-9mhp-454m-in-tar7520-33555e897c44bba5).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- greptile_comment -->

<h3>Greptile Summary</h3>

This PR remediates GHSA-r292-9mhp-454m by patching the transitive `tar`
dependency from 7.5.20 to 7.5.22 in the `agentex-ui` service. The fix
uses the existing `overrides` block to pin `tar` and raises the floor so
future re-locks cannot float back to a vulnerable version.

- **`package.json`**: `overrides.tar` floor raised from `^7.5.16` to
`^7.5.21`, ensuring the constraint permanently excludes the vulnerable
7.5.16–7.5.20 range.
- **`package-lock.json`**: Lockfile-only update resolving `tar` to
7.5.22 with an updated integrity hash; no other dependencies were
changed.

<details><summary><h3>Confidence Score: 5/5</h3></summary>

Minimal, targeted lockfile-only change with no app code touched — safe
to merge.

The diff is entirely confined to raising a semver floor in `overrides`
and re-locking a single transitive dependency to a newer patch. The
7.5.x line is fully compatible with `@tailwindcss/oxide@4.1.11`, and the
change introduces no new dependencies or logic.

**Files Needing Attention:** No files require special attention.
</details>

<details><summary><h3>Important Files Changed</h3></summary>

| Filename | Overview |
|----------|----------|
| agentex-ui/package.json | Raises the `overrides.tar` floor from
`^7.5.16` to `^7.5.21` to prevent the lockfile from resolving back to a
vulnerable version on future re-locks. |
| agentex-ui/package-lock.json | Lockfile-only update: resolves `tar`
from 7.5.20 to 7.5.22 with updated integrity hash; no transitive-closure
churn or other dependency changes. |

</details>

<details><summary><h3>Flowchart</h3></summary>

```mermaid
%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["@tailwindcss/oxide@4.1.11"] -->|"requires tar ^7.4.3"| B["tar (transitive)"]
    C["agentex-ui/package.json\noverrides.tar"] -->|"force-pin floor"| B
    B -->|"Before: 7.5.20\n(GHSA-r292-9mhp-454m)"| D["❌ Vulnerable"]
    B -->|"After: 7.5.22\n(patched)"| E["✅ Fixed"]
    C -->|"floor: ^7.5.16 → ^7.5.21"| F["Future re-locks cannot\nresolve < 7.5.21"]
```
</details>

<sub>Reviews (1): Last reviewed commit: ["fix(agentex-ui): bump tar
7.5.20 -&gt;
7.5...."](3143985)
| [Re-trigger
Greptile](https://app.greptile.com/api/retrigger?id=48133646)</sub>

<!-- /greptile_comment -->

Co-authored-by: scale-prodsec[bot] <262621375+scale-prodsec[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: scale-prodsec[bot]

agentex-ui/package-lock.json

@@ -58,7 +58,7 @@
     "cross-spawn": "^7.0.5",
     "postcss": "^8.5.10",
     "sharp": "^0.35.0",
-    "tar": "^7.5.16"
+    "tar": "^7.5.21"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.1",