Fix brace-expansion DoS advisories (REV-72)

Clears two high-severity Dependabot advisories on brace-expansion:

- GHSA-3jxr-9vmj-r5cp: DoS via exponential-time expansion of consecutive
  non-expanding {} groups (patched in 1.1.16 / 2.1.2).
- GHSA-mh99-v99m-4gvg (CVE-2026-14257): DoS via unbounded expansion length
  causing an OOM crash; patched in 5.0.8 and backported to 1.1.17 / 2.1.3.

Both installed copies were stale relative to their own semver ranges, so
`npm update brace-expansion` was sufficient — lockfile-only, no override
entry and no manifest change:

- rimraf@2 -> glob@7 -> minimatch@3 (also eslint): 1.1.15 -> 1.1.17.
  Reachable from the production tree.
- mocha@11 -> minimatch@9: 2.1.1 -> 2.1.3. Dev-only.

Deliberately not overridden to 5.0.8: brace-expansion 5.x exports a named
`expand` (exports.expand = expand) while minimatch does
`const expand = require('brace-expansion')`, so forcing 5.x would break
glob/rimraf/eslint/mocha at runtime. The maintenance backports are the fix.

Verified against the installed copies: normal expansion unchanged
(a{b,c}d{1..3} -> abd1,abd2,abd3,acd1,acd2,acd3 on both); 40 consecutive
empty {} groups expand in 0ms; 6 chained 200KB groups now cap at 3.6M chars
via the new EXPANSION_MAX_LENGTH=4000000 guard instead of growing unbounded.
tsc --noEmit clean; eslint and mocha still resolve their globs.

Note: npm audit and Dependabot will keep flagging GHSA-mh99-v99m-4gvg until
GitHub amends it — the advisory declares one flat range `<= 5.0.7` with
first_patched_version 5.0.8 and has not yet been updated for the 1.1.17 /
2.1.3 backports published 2026-07-28/29. The installed code is patched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: revopushbot