chore(deps): bundle the three open dependabot lockfile bumps

[ryanio]

Motivation

Three open dependabot PRs, all lockfile-only transitive bumps. They all edit the same yarn.lock, so merging them one at a time forces the other two to rebase and burns a CI run each time. Bundling means one review and one CI run instead of three.

Supersedes #1408, #1410 and #1412. Dependabot's commits are cherry-picked unchanged, so authorship and the advisory trail are preserved.

PR	Bump	Advisory
#1412	brace-expansion 2.0.1 to 2.1.4	GHSA-mh99-v99m-4gvg, CVE-2026-13149 (ReDoS)
#1410	tar 6.1.13 to 7.5.22	dependabot security update
#1408	immutable 4.1.0 to 4.3.9	GHSA-v56q-mh7h-f735, GHSA-xvcm-6775-5m9r, CVE-2026-29063

Solution

One file changes and it is yarn.lock. No package.json, no contract source, no submodule.

None of the three packages appears in this repo's dependencies or devDependencies, so all are transitive. yarn.lock is not published to npm, so no consumer of the package is affected. The Solidity dependencies come from the git submodules in .gitmodules rather than npm, so the contracts are untouched.

The tar change is worth a second look because 6 to 7 is a major version. It needs no package.json edit because resolutions already pins "tar": ">=4.4.18", which 7.x satisfies. tar 7 requires Node 18 or newer and CI runs 18.15.0, so the floor is met. This is the only item in the bundle with real breakage potential, and the Node jobs (Build Artifacts, Run Tests, Run Reference Tests, Run Linters) are what exercise it.

Verification

Resolved versions after bundling:

brace-expansion 2.1.4
tar             7.5.22
immutable       4.3.9

All three cherry-picks applied without conflict, and the diff against main touches nothing but yarn.lock.

The Forge jobs are red here, and not because of this change

main still carries the .gitmodules branch = <tag> pins that break forge install before anything compiles, so all four Forge jobs fail on any branch cut from it. #1416 fixes that. Once it merges, this branch needs a rebase and the Forge jobs will go green.

The jobs that actually validate a lockfile change are the Node ones, and those run independently of Foundry. Read them, not the Forge ones, when reviewing this.

Node-side result

Every non-Foundry check passed on this branch, which is the meaningful validation for a lockfile change and covers the tar 7 question:

Build Artifacts                pass
Run Linters                    pass
Run Tests                      pass
Run Reference Tests            pass
Run Reference Coverage Tests   pass
CodeQL / Analyze               pass
Socket Security                pass

The four Forge jobs fail at forge install for the reason described above, which is on main and not in this diff.