fix(deps): bump qs 6.15.1→6.15.2 and tmp 0.2.4→0.2.6 to clear osv findings (#151)

## Summary

Clears the two transitive vulnerabilities flagged by the `osv` CI job
against `pnpm-lock.yaml`. Both were pre-existing on `main` (surfaced,
not caused, by the recent release PRs).

| Package | Was | Now | Advisory | CVSS | Path |
|---|---|---|---|---|---|
| `qs` | 6.15.1 | **6.15.2** |
[GHSA-q8mj-m7cp-5q26](https://osv.dev/GHSA-q8mj-m7cp-5q26) | 6.3 |
`@opencodehub/mcp` → express@5 → body-parser (**runtime**) |
| `tmp` | 0.2.4 | **0.2.6** |
[GHSA-ph9p-34f9-6g65](https://osv.dev/GHSA-ph9p-34f9-6g65) | 7.7 |
`commitizen` → inquirer → external-editor (**dev-only**) |

## Changes

Overrides live in `pnpm-workspace.yaml` (pnpm v11 requires them there,
not in `package.json`). Widened the existing `tmp` override and added a
new `qs` line:

```diff
   picomatch@<2.3.2: "2.3.2"
-  tmp@<0.2.4: "0.2.4"
+  qs@<6.15.2: "6.15.2"
+  tmp@<0.2.6: "0.2.6"
   dompurify@<3.4.0: "3.4.0"
```

Lockfile regenerated (`pnpm install --lockfile-only`, idempotent). Diff
is minimal — **21 lines**, only the four target package definitions +
their resolution sites. No unrelated churn.

## Verification

- `osv-scanner scan source --lockfile=pnpm-lock.yaml` → **No issues
found** (exit 0) across all packages.
- `pnpm why qs` → single version **6.15.2**, reaches express@5.2.1 /
body-parser@2.2.2 cleanly. No peer-dep errors.
- Vulnerable versions absent from lockfile; `qs@6.15.2` + `tmp@0.2.6`
present.

## Test plan
- [x] osv-scanner local: 0 findings
- [x] `pnpm install` exit 0, single-version qs resolution
- [x] commitlint-compatible commit message

Author: theagenticguy

pnpm-lock.yaml

@@ -13,7 +13,8 @@ overrides:
   minimatch@<3.1.4: "3.1.4"
   minimatch@>=9.0.0 <9.0.7: "9.0.7"
   picomatch@<2.3.2: "2.3.2"
-  tmp@<0.2.4: "0.2.4"
+  qs@<6.15.2: "6.15.2"
+  tmp@<0.2.6: "0.2.6"
   dompurify@<3.4.0: "3.4.0"
   hono@<4.12.18: "4.12.18"
   ip-address@<10.1.1: "10.1.1"