deps: drop the pnpm override apparatus, scope the audit gate to prod deps

.github/workflows/ci.yml

@@ -139,8 +139,11 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      # Fails on high/critical advisories. If upstream advisories with no
-      # released fix start blocking unrelated PRs, relax with
-      # `continue-on-error: true` rather than deleting the job.
+      # Fails on high/critical advisories in production dependencies only —
+      # the tree that builds the site and serves /api/search. Dev-tool
+      # advisories (eslint, type packages) don't gate merges; Dependabot
+      # still bumps them. If an unfixed upstream advisory starts blocking
+      # unrelated PRs, relax with `continue-on-error: true` rather than
+      # deleting the job.
       - name: Dependency audit
-        run: pnpm audit --audit-level high
+        run: pnpm audit --prod --audit-level high

package.json

@@ -24,29 +24,10 @@
     "@types/node": "24.13.3",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.4",
-    "eslint": "^9.39.4",
+    "eslint": "^9.39.5",
     "eslint-config-next": "16.3.2",
-    "minimatch": "9.0.9",
     "postcss": "^8.5.26",
     "tailwindcss": "^4.3.3",
     "typescript": "^6.0.3"
-  },
-  "pnpm": {
-    "overrides": {
-      "brace-expansion@1.1.11": "1.1.12",
-      "brace-expansion@2.0.1": "2.0.2",
-      "js-yaml": "^4.1.1",
-      "mdast-util-to-hast": "^13.2.1",
-      "tar": "^7.5.8",
-      "minimatch": "9.0.9",
-      "eslint>minimatch": "9.0.7",
-      "eslint-config-next>minimatch": "9.0.7",
-      "eslint-plugin-import>minimatch": "9.0.7",
-      "minimatch@<9": ">=3.1.3",
-      "minimatch@>=9.0.0 <9.0.7": ">=9.0.7",
-      "postcss@<8.5.10": "8.5.14",
-      "ajv@<6.14.0": "6.15.0",
-      "esbuild@<0.28.1": ">=0.28.1"
-    }
   }
 }