Fix CVE-2026-102277 in GraphQL codegen dependencies

[warp-agent-staging]

Description

Update the GraphQL codegen tooling's brace-expansion resolution to a patched 2.1.x release. The locked 2.1.2 version is affected by CVE-2026-102277 / GHSA-q2hr-2g5m-vwhr; the lockfile now selects 2.1.7. This only changes development dependencies and leaves generated schema and runtime code untouched.

Linked Issue

Dependabot alert 39.

• The linked issue is labeled ready-to-spec or ready-to-implement. Dependabot alerts are not GitHub issues.
• Where appropriate, screenshots or a short video of the implementation are included below. No rendered UI changed.

Testing

• yarn --cwd crates/warp_graphql_schema install --frozen-lockfile --ignore-scripts --non-interactive --no-progress passed.
• yarn --cwd crates/warp_graphql_schema run generate --help loaded the codegen CLI without writing generated files.
• yarn --cwd crates/warp_graphql_schema audit --json --level moderate reported zero advisories across 436 dependencies.
• Asserted installed brace-expansion is 2.1.7; git diff --check passed.
• I have manually tested my changes locally with ./script/run. The desktop app does not exercise this development-only Yarn dependency.

Agent Mode

• Warp Agent Mode - This PR was created by a Factory run, not Warp Agent Mode.

CHANGELOG-NONE

[warp-agent-staging]

This PR was generated with Warp.

Comment @warp-staging-factory on this PR to send it follow-up work.

  

[acarl005]

@cla-bot check

[cla-bot]

The cla-bot has been summoned, and re-checked this pull request!

[warp-factories]

Warp encountered an internal error while working on this task.

Error Details:
The agent did not report in-progress before the boot deadline.