fix(deps): override esbuild ^0.28.1 to clear OSV advisories

[nocoo]

Summary

• Pin esbuild to ^0.28.1 via root package.json overrides. drizzle-kit 0.31.10 still requires ^0.25.4 and tsx 4.21.0 requires ~0.27.0, both of which resolved to vulnerable releases (0.25.12 / 0.27.7). Neither upstream has shipped a fix yet, so an override is the smallest unblock and gets every transitive resolution onto 0.28.1.
• Drops the now-unreachable GHSA-67mh-4wv8-2f99 ignore — the override also clears the @esbuild-kit/core-utils pull-through that the previous ignore was working around, so osv-scanner.toml is empty.

Advisories cleared

Advisory	Severity	Where	Fix
GHSA-gv7w-rqvm-qjhr	High (8.1)	drizzle-kit → esbuild@0.25.12, tsx → esbuild@0.27.7	esbuild ≥ 0.28.1
GHSA-g7r4-m6w7-qqqr	Low (2.5)	tsx → esbuild@0.27.7	esbuild ≥ 0.28.1
GHSA-67mh-4wv8-2f99	n/a	@esbuild-kit/core-utils → esbuild@0.18.20 (previously ignored)	esbuild ≥ 0.28.1 (now covered by override, ignore removed)

This unblocks PR #77 (quality / L1+G1+G2 was failing on these advisories) and restores green on main.

Test plan

• bun install → 800 packages, no resolution conflicts
• bun pm ls --all | grep esbuild → every esbuild copy is now 0.28.1
• bun run lint clean
• bun run typecheck clean
• bun run test → 945 passing (71 files)
• bun run build succeeds
• osv-scanner scan source --lockfile=bun.lock → no issues found
• drizzle-kit generate --help loads (sanity check that the bumped esbuild still satisfies drizzle-kit's runtime use of the API)