#9422 chore(deps): dependency hygiene cleanup

Summary

• Bump the qs (6.16.0 → 6.16.1, GHSA-6pq8) and fast-uri (3.1.8 → 3.1.9, GHSA-w74x/xhq7/wjr9/333x) override pins; the pinned versions were themselves the vulnerable releases
• Drop the artillery devDependency (~300 lockfile entries, plus its csv-parse 4 / moment advisories); the three load:workflow:* scripts run bunx artillery@2.0.34
• Remove the minimatch / brace-expansion overrides: forcing minimatch 10 (no default export) onto CommonJS consumers like @electron/asar (minimatch_1.default(...)) is a latent TypeError, and every major line now resolves to a patched backport (3.1.5 / 5.1.9 / 9.0.9 / 10.2.6, brace-expansion 1.1.21 / 2.1.7 / 5.0.12)
• Remove redundant overrides (socket.io, drizzle-orm, baseline-browser-mapping resolve the same versions without them; joi only came in through artillery), sharp from trustedDependencies (no lifecycle scripts), and the temporary electron release-age exclude. The electron@latest canary passes --minimum-release-age=0 so it still tests the real latest
• @xyflow/react is a devDependency of workflow-persistence (type-only import)
• Declare buffer, process, chai, tinyrainbow, which the sandbox bundle build imports but which only resolved through hoisting

Type of Change

• Chore (dependency maintenance)

Testing

• bun install lock diff: only the intended versions changed, no other version churn; 2968 → 2669 lockfile entries
• bun audit: 47 → 40, nothing new; no minimatch/brace-expansion findings
• bun pm untrusted unchanged apart from artillery-only packages; build:sandbox-bundles output identical with and without the change
• biome on changed files; type-check, check:audits (incl. knip) and the test suites run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)