fix(dependencies): refresh browserslist lock path

[drewstone]

Summary

• refresh the remaining high Dependabot path for browserslist
• consolidate the Yarn lockfile on browserslist 4.28.8
• keep the development-only advisory out of runtime dependency paths

Verification

• yarn install --immutable
• yarn nx run-many --all --target=typecheck --outputStyle=static
• pre-push hook: lint, test, and build

Live baseline before merge: 0 critical / 1 high (#420). No alert was dismissed.

[tangletools]

✅ Auto-approved drewstone PR — 1fe6233d

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-09-02T00:19:54Z}