chore(deps): resolve high brace-expansion findings

[corwinm]

Summary

• update @vscode/test-cli from 0.0.12 to 0.0.15 before changing transitive resolutions
• align its direct test runtime, @vscode/test-electron, from 2.5.2 to 3.1.0; test-cli 0.0.15 develops against the v3 runtime, which supports VS Code 1.131's renamed platform executables
• extend the existing scoped brace-expansion overrides to cover the new vulnerable ranges from GHSA-mh99-v99m-4gvg / CVE-2026-14257
• resolve the remaining test-cli and npm-run-all paths to patched releases without upgrading unrelated direct dependencies

Lockfile review

The @vscode/test-cli update refreshes its declared toolchain family, including c8 10.1.3 → 11.0.0, chokidar 3.6.0 → 5.0.0, enhanced-resolve 5.20.1 → 5.24.5, mocha 11.7.5 → 11.7.6, and their associated minimatch/yargs dependencies. Obsolete chokidar v3 support packages are removed.

The @vscode/test-electron update changes only that package and its shared semver resolution. It fixes the VS Code 1.131 launch path (Contents/MacOS/Code rather than the legacy Contents/MacOS/Electron) and matches the Node 22 floor already used by the repository and CI.

The vulnerable paths now resolve as follows:

• @vscode/test-cli > mocha > minimatch > brace-expansion: 2.1.2 → 2.1.4
• npm-run-all > minimatch > brace-expansion: 1.1.16 → 1.1.18
• newer minimatch paths remain on patched 5.0.8 or 5.0.9

No unrelated direct dependency upgrades were included.

Verification

• pnpm install --frozen-lockfile
• pnpm audit --json — 0 vulnerabilities
• pnpm why brace-expansion — all paths resolve to patched 1.1.18, 2.1.4, 5.0.8, or 5.0.9
• pnpm test — 26 passing against VS Code 1.131.0
• pnpm run package
• pnpm run verify:release
• pnpm run watch smoke test — both esbuild and TypeScript watchers started; TypeScript reported 0 errors