fix(security): patch transitive nanoid advisory

[CodeinScrubs]

What changed

• Override the transitive build-time nanoid 3.x dependency from 3.3.17 to patched 3.3.18 and regenerate the lockfile.
• Record CVE-2026-67213 / GHSA-2v37-7h3g-55p8 in the still-unpublished 0.3.1 source-release notes.
• Disable persisted checkout credentials in the non-publishing release-evidence workflow.

Root cause and impact

GitHub updated the high-severity nanoid advisory at 2026-08-13 15:43 UTC. Earlier audits passed, but protected release-preparation run 31719466604 then resolved the new advisory and correctly stopped at pnpm audit before release packing or SBOM generation.

The affected path is Vite -> PostCSS -> nanoid in repository development/demo tooling. No published @bidilens/* runtime dependency includes nanoid, and npm publication has not occurred. Even with that boundary, the release source and lockfile should not knowingly retain a vulnerable dependency.

Evidence

• pnpm install --frozen-lockfile resolves only nanoid@3.3.18.
• pnpm run deps:audit: no known vulnerabilities.
• pnpm run check: 401/401 tests, 932-case corpus, types, lint, docs, builds, and Action checks passed.
• pnpm run release:check: all 12 0.3.1 tarballs installed and executed in a clean consumer; all packed examples and size budgets passed.
• git diff --check passed.

Release boundary

This PR does not publish to npm or create a tag/release. After merge, the non-publishing Windows release-preparation workflow must be rerun and pass before an explicit npm release decision.