chore(deps): bump vitest to 4.1.11 and repin nanoid to 3.3.19

[everest-an]

Change

Fix the pnpm audit --audit-level=moderate gate, which currently fails on main's dependency set. Two advisories had their patched versions move after the previous pin was set:

Severity	Package	Was	Now
high	nanoid (GHSA-2v37-7h3g-55p8)	3.3.17 override	3.3.19
moderate	vitest / @vitest/mocker (GHSA-82fw-gwwq-j7x9)	^4.1.10	^4.1.11

• The nanoid advisory's first patched version was revised upward from 3.3.17 to 3.3.18, so the existing override no longer satisfies the gate. 3.3.19 stays inside postcss's ^3.3.16 range.
• The vitest advisory was published 2026-09-08 with first patched 4.1.11. Five devDependency ranges bumped.

Both are devDependency-only paths reached through vite/postcss. There is no runtime surface in this repository.

Note on timing

This failure is not caused by #25. pnpm audit queries the advisory database live, so any run after 2026-09-08 fails regardless of branch — main is equally affected if its CI workflow is re-run. #25 changed no dependencies.

Verification

pnpm audit --audit-level=moderate   ->  No known vulnerabilities found
pnpm test:ts                        ->  52 tests pass (core 15, reference-engine 18,
                                        awareness-adapter 12, examples 7) on vitest 4.1.11
node scripts/check-vectors.mjs      ->  PASS — 5 transitions, 12 rejection selectors
node scripts/build-test-vectors-v2.mjs --check
                                    ->  PASS — v2.json reproduces byte-for-byte
node scripts/check-erc-assets.mjs   ->  in sync + 3 CC0 assets

Boundaries

No protocol hash algorithm, state-machine behaviour, golden vector, ERC draft text, or erc/assets/ content changes. Frozen G4 evidence is untouched. pnpm-lock.yaml and pnpm-workspace.yaml change only in the two pinned versions above.

The Solidity suite (contracts/) was not run locally — Foundry is not installed in this environment; it is covered by the Solidity and invariants CI job.