fix(security): remove unused semantic-release, pin serverless's tar >=7.5.16

The tar flagged by Dependabot alert 250 (CVE-2026-53655 / GHSA-vmf3-w455-68vh,
tar <= 7.5.15) is bundled inside the npm package, reached via
semantic-release -> @semantic-release/npm -> npm. npm overrides cannot rewrite
bundled dependencies, so the scoped override from #739 cannot reach it.

semantic-release is unused: no .releaserc, no release key, not referenced in any
workflow or npm script. Releases are tag-driven via release.yml. Removing it
drops npm and its bundled tar (-399 packages).

Also raises #739's override floor from ^7.5.8 to ^7.5.16, since ^7.5.8 permits
7.5.15 -- the version this advisory affects. Resolves to tar@7.5.19 either way.

Single tar@7.5.19 remains; no tar advisories. build, lint and 362 tests pass.

Refs: GHSA-vmf3-w455-68vh

Author: sid88in