fix(deps): override shell-quote to ^1.8.4 (GHSA-w7jw-789q-3m8p)

Pins the shell-quote transitive dependency (reached via launch-editor,
inlined into the published devframe dist through tsdown's onlyBundle)
past the critical argument-injection advisory. Removes plan 002 now
that it's implemented.

Author: antfubot

plans/002-shell-quote-security-override.md

@@ -14,7 +14,7 @@ changes are allowed as long as they're marked).
 | Plan | Title | Cat | Priority | Effort | Depends on | Status |
 |------|-------|-----|----------|--------|------------|--------|
 | 001 | Add missing `typecheck` scripts (inspect + 5 examples) | dx | P1 | S | — | TODO |
-| 002 | Clear the critical `shell-quote` advisory in the bundle | security/deps | P1 | S | — | TODO |
+| 002 | Clear the critical `shell-quote` advisory in the bundle | security/deps | P1 | S | — | DONE |
 | 003 | Reject cross-origin WebSocket upgrades ⚠️ | security | P1 | S | — | TODO |
 | 004 | Stop git argument injection via `ref`/`hash` | security/bug | P1 | S | — | TODO |
 | 005 | Don't cache a rejected RPC `setup()` promise | bug | P1 | S | — | TODO |

plans/README.md

@@ -29,6 +29,7 @@ overrides:
   chokidar: ^5.0.0
   crossws: ^0.4.8
   semver: ^7.8.1
+  shell-quote: ^1.8.4
 catalogs:
   build:
     '@antfu/ni': ^30.1.0