Fix nanoid audit failure in release checks

[rogerchappel]

Summary

• override the transitive development dependency nanoid at patched release 3.3.17
• refresh the lockfile so clean installs resolve outside GHSA-2v37-7h3g-55p8
• document the dependency and CI audit-gate repair in the changelog

Commits

• ca1ca7f fix(deps): override nanoid to 3.3.17
• eb02c1d docs(changelog): note nanoid audit repair

Verification

npm ci
npm ls nanoid
npm audit
npm audit --omit=dev
npm run release:check
git diff --check origin/main..HEAD

npm ls nanoid resolves nanoid@3.3.17 overridden; both audit commands report zero vulnerabilities; release:check passes 72 tests, build, lint, typecheck, CLI smoke, and package smoke. CI will exercise Node 20.19.0, 22, and 24.