[GenAICloudDevOps]

Follow-up to the glob/minimatch override fix: alert #34 (minimatch, GHSA-g3hv-75wg-m249) stayed open after that merge because Dependabot then counted the remaining old copies — minimatch 5.1.9 inside filelist (electron-builder chain) and inside archiver (exceljs chain), with further old copies (3.1.5, 9.0.9) nested in the Electron packaging tools behind them.

This change replaces the scoped minimatch overrides with a single global override, "minimatch": "^11.0.1", so every consumer in the tree resolves to the patched major. The scoped overrides for @eslint/config-array, @typescript-eslint/typescript-estree, app-builder-lib, eslint, and test-exclude, and the nested readdir-glob pin, are removed as redundant — the observable tree is now exactly one minimatch copy: 11.0.3.

Scope note: this deliberately forces the ESM-only minimatch 11 into the CommonJS Electron packaging tools (@electron/asar, @electron/universal, filelist, dir-compare). The maintainer has confirmed the Electron app is not currently in use and asked for the fix from a vulnerability-closure point of view. The packaging path is not covered by the unit suite; module-load smokes for those tools pass, and a full packaging run should be re-validated before the next Electron release build.

Verification in a clean scratch copy of main (28aba2f):

• Tree inventory: exactly one minimatch entry, 11.0.3; glob unchanged at 14.0.3
• npm ci installs the lockfile cleanly (in sync)
• tsc clean, eslint clean, prettier --check clean
• Full test suite: 1434/1451 pass; only the 3 known fetch_url sandbox-DNS failures, identical on unmodified main
• Load smokes on minimatch 11: filelist, @electron/asar, dir-compare, test-exclude all load; exceljs write/read round-trip passes
• Socket gate (API) for minimatch 11.0.3: PASS (checked with the earlier PR; same resolved version)