fix(deps): clear pnpm audit (MCP SDK, source-map-js, braces)

[finalerock44]

Three high advisories now fail pnpm audit --audit-level moderate on dev, so every PR, the release PR included, goes red at the audit step:

• @modelcontextprotocol/sdk <1.31.0 (GHSA-6qxp-vccf-f47h). A runtime dependency that ships in dcd-mcp. Raise the floor to ^1.31.0 (resolves 1.32.1). dcd-mcp only uses the stdio server, so the 1.31/1.32 client OAuth and redirect changes don't touch it.
• source-map-js <1.2.2 (GHSA-68fv-2mgg-jv7q). Dev only, via eslint-plugin-unicorn > @eslint/css-tree. Override to 1.2.2.
• braces <=3.0.3 (GHSA-vfj7-8cjw-p6xm). Dev only, via shx > shelljs > fast-glob > micromatch, which the build script runs on fixed paths. No patched release exists, so ignore it in auditConfig. Drop the ignore once braces ships a fix, or drop shx.

What & why

Type of change

• fix — bug fix
• feat — new feature
• perf — performance improvement
• refactor — code change that's neither a fix nor a feature
• docs — documentation only
• chore / ci / build / test — tooling, no user-facing change
• Breaking change (title has ! or PR notes a BREAKING CHANGE:)

Checklist

• PR title follows the Conventional Commits format (see comment above)
• pnpm lint passes
• pnpm typecheck passes
• pnpm build passes
• I have not bumped the version or edited CHANGELOG.md (release-please handles this)
• I have signed the CLA (the bot will prompt on first contribution)
• Docs / README.md / STYLE_GUIDE.md updated if behaviour or output changed

How to test