chore(deps): regenerate the lockfile for the minor-and-patch group (supersedes #638)

[williamzujkowski]

Applies the seven dependency bumps from #638 on top of current main, with the lockfile regenerated natively — the workaround #540 documents.

The bot's own lockfile could not be used as-is. It dropped the overrides: header and re-resolved satori back to the vulnerable fflate@0.7.3 (GHSA-px8p-9vwx-vf98).

Per #540's standing instruction — "Do not repair only the header: regenerate and inspect the resolved graph" — the graph was inspected rather than assumed:

$ grep -n fflate astro-site/pnpm-lock.yaml
8:    satori>fflate: 0.7.5
1780: fflate@0.7.5:
6051:       fflate: 0.7.5        <- satori@0.33.4

fflate@0.7.3 is absent from the tree entirely.

scripts/ci/check-lockfile-overrides.py (added in #639) passes here — and it is the check that rejects the bot's version of this same lockfile.

package	from	to
@astrojs/markdown-remark	^7.3.0	^7.3.1
astro	^7.3.1	^7.3.3
markdown-it	^15.0.1	^15.0.2
svelte	^5.57.0	^5.57.1
@typescript-eslint/parser	^8.69.0	^8.70.0
eslint	^10.10.0	^10.11.0
eslint-plugin-astro	^3.1.0	^3.2.1

Closes #638 once merged.

Verification

frozen install clean · build 0 · astro check 0 errors · eslint 0 errors · 5/5 design audits · 48/48 unit

🤖 Generated with Claude Code

https://claude.ai/code/session_015AvTumDxQ2ntLDwsSefHtf

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​astrojs/​markdown-remark@​7.3.0 ⏵ 7.3.1	+1		+1	-1
	npm/​@​typescript-eslint/​parser@​8.69.0 ⏵ 8.70.1
	npm/​markdown-it@​15.0.1 ⏵ 15.0.2			+1	-2
	npm/​svelte@​5.57.0 ⏵ 5.57.1	+1		+1	+2
	npm/​astro@​7.3.1 ⏵ 7.3.4			+1
	npm/​eslint-plugin-astro@​3.1.0 ⏵ 3.2.1				-1
	npm/​eslint@​10.10.0 ⏵ 10.11.0	+1

View full report