chore(deps): patch shellcheck transitive dependencies

[corwinm]

Summary

• Keep the direct shellcheck dev dependency on the current ^4.1.0 release.
• Add narrow npm overrides for the vulnerable archive-download transitive packages used by shellcheck@4.1.0:
  • @felipecrs/decompress-tarxz → 5.0.6
  • @xhmikosr/decompress-unzip → 8.2.1
• Refresh package-lock.json so file-type resolves to a non-vulnerable version.

Audit notes

• This addresses the 5 moderate npm audit findings flowing through shellcheck via file-type / decompress dependencies.
• The first version of this PR followed npm's automated fix suggestion and changed shellcheck from ^4.1.0 to ^3.1.0; that looked like a downgrade and has been corrected.
• After this update, npm audit --audit-level=moderate reports 0 vulnerabilities.

Verification

• npm run fmt:check
• npm run lint
• npm run shell:fmt:check
• npm run shell:check
• npm run typecheck
• npm test (127 tests passing)
• npm run check
• npm audit --audit-level=moderate
• npx shellcheck --version (ShellCheck 0.11.0)