Clear the npm-audit advisories and align the dependency posture with Docsy

[chalin]

• Scope:
  • clears every advisory npm audit reports for the committed lock (0 remain)
  • aligns the override spec, advisory-package versions and npm floor with Docsy
• Out of scope:
  • Node, Hugo, theme and Renovate bumps: not applicable to this change
  • an audit gate for this repo (the theme's tests/npm-audit.test.mjs idiom): tracked on the Docsy supply-chain task board
• Takes the postcss-cli major: the only route off chokidar 3, the braces chain's root
  • the theme has no postcss-cli to mirror, so the version stands on its own age (past the cooldown)
  • the RTL build output (rtlcss + autoprefixer) is byte-identical before and after
• Drops the fsevents allowScripts row: the package left the lock with chokidar 3, and allowScripts stays exact to the locked install-script inventory
• Takes source-map-js on a one-time release-age exception (inside the 7-day min-release-age): the tarball, identical by integrity, Docsy vetted byte-for-byte against upstream in Clear npm-audit advisories for katex, smol-toml, and source-map-js docsy#2849
• Exposure: all dev-only (PostCSS/Autoprefixer build tooling, hugo-extended's installer, sass's optional fallback); nothing shipped

[netlify]

✅ Deploy Preview for goldydocs ready!

Name	Link
🔨 Latest commit	295879f
🔍 Latest deploy log	https://app.netlify.com/projects/goldydocs/deploys/6ac55719106cb30008ebbd38
😎 Deploy Preview	https://deploy-preview-518--goldydocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.