fix(deps): bump brace-expansion to 5.0.12

[florianmousseau]

Three brace-expansion DoS advisories (high) were published and no Dependabot PR covers them yet.

Lockfile, package by package: brace-expansion 5.0.9 -> 5.0.12 (dev, via minimatch). Nothing added, nothing else changed; nothing ships in the package.

npm audit --audit-level=high --package-lock-only: exit 1 before, exit 0 after.

[claude]

Claude finished @florianmousseau's task in 16s —— View job

---

Review checklist

• Gather context (diff, package.json, commit log)
• Review change against quality-gate criteria

Findings

Clean. This is a lockfile-only dependency bump (brace-expansion 5.0.9 → 5.0.12, transitive dev dependency via minimatch), 3 insertions / 3 deletions, no source files touched. Nothing to flag against the review criteria (no dead code, no duplication, no speculative abstraction, no architectural drift, no tests, no swallowed errors, no new dependency introduced — just a patched version of an existing transitive dep).