Bump seroval to 1.5.3 and drop the CVE-2026-59940 suppression

[Kenny-Heitritter]

Context

The first opencode-staging-branch build in ~3 weeks (c14cd551, 2026-07-31) failed closed at the security-gate step on a single new CRITICAL:

seroval  CVE-2026-59940  CRITICAL  installed 1.4.1  fixed 1.5.3
  seroval.fromJSON() Promise resolver type confusion invokes
  attacker-controlled methods during deserialization

This blocked the CodeQ deployment rollout (#16), so the CVE was temporarily suppressed in packages/opencode/.trivyignore to unblock it. That suppression is a stopgap, not a risk acceptance — a fix exists and the bump is cheap.

What to do

1. Bump the existing pin in the root package.json overrides block (currently package.json:103):

   -    "seroval": "1.4.1"
   +    "seroval": "1.5.3"

2. Run bun install to refresh bun.lock. There is exactly one seroval resolution today, forced by this override above solid-js's requested ~1.3.0, so this should stay a single resolution.
3. Remove the CVE-2026-59940 block from packages/opencode/.trivyignore.
4. Confirm the TUI still builds and runs (bun run build --single in packages/opencode); @opentui/solid -> solid-js is the only consumer.

Acceptance criteria

• Root overrides.seroval is 1.5.3 (or later) and bun.lock resolves a single seroval at that version
• CVE-2026-59940 entry removed from packages/opencode/.trivyignore
• opencode-staging-branch passes security-gate with the entry gone
• TUI builds and launches

Notes

Reachability assessment recorded in the .trivyignore entry: the vulnerable fromJSON() is solid's SSR/hydration deserializer, and the CLI does no hydration (no hydrate / renderToString / renderToStream / @solidjs/start; its one solid-js/web import is Dynamic). So exposure is believed nil — but that is an argument for this being low-urgency, not for leaving it suppressed indefinitely.

Blocks nothing, but should land before the suppression is forgotten. Related: #16.