📦 Patch Dependabot security dependencies

[baealex]

🎯 Goal

• Resolve remaining Dependabot security alerts after merging the existing update PRs.
• Keep dependency changes scoped to patched versions and lockfile refreshes.

🔧 Core Changes

• Update root pnpm dev dependency from 10.28.2 to 10.34.4.
• Update islands packageManager to pnpm@10.34.4.
• Add islands pnpm overrides for patched transitive dependencies: @babel/core, dompurify, form-data, js-yaml, linkify-it, and markdown-it.
• Regenerate package-lock.json and backend/islands/pnpm-lock.yaml.

🤔 Key Decisions

• Kept pnpm on the patched 10.x line instead of taking the 11.x major release.
• Used pnpm overrides because the vulnerable packages are transitive dependencies.

🧪 Verification Guide

How to verify

1. Run npm audit --audit-level=low.
2. Run npx -y pnpm@10.34.4 --dir backend/islands audit --audit-level=low.
3. Run npm run islands:lint.
4. Run npm run islands:type-check.

Expected result

• Audits report no known vulnerabilities.
• Lint and type-check complete successfully.

✅ Checklist

• Lint completed
• Type-check completed
• Tests completed
• Documentation updated (if needed)