fix: upgrade convict to 6.2.5 (CVE-2026-33863)

[anupamme]

Summary

Upgrade convict from 6.2.4 to 6.2.5 to fix CVE-2026-33863.

Vulnerability

Field	Value
ID	CVE-2026-33863
Severity	CRITICAL
Scanner	trivy
Rule	CVE-2026-33863
File	pnpm-lock.yaml
Assessment	Likely exploitable

Description: Convict has prototype pollution via load(), loadFile(), and schema initialization

Evidence

Scanner confirmation: trivy rule CVE-2026-33863 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Changes

• package.json
• pnpm-lock.yaml

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.