fix(dev-1702): bump postcss to 8.5.23

[spur-vuln-author]

Context

Batched group (ticket_group_key tg:postcss:pnpm-lock.yaml, 4 advisories) against postcss, all in pnpm-lock.yaml:

• GHSA-fxqj-rqcc-2cmp — postcss < 8.5.23 (medium)
• GHSA-r28c-9q8g-f849 — postcss < 8.5.18 (high)
• GHSA-6g55-p6wh-862q — postcss < 8.5.12 (high)
• GHSA-qx2v-qp2m-jg93 — postcss < 8.5.10 (medium)

Transitive dependency (not declared in any package.json), resolved via pnpm-lock.yaml. No Dependabot PR exists for any of these, so this PR was constructed directly from the highest first_patched_version across the group (8.5.23).

Test evidence

No Dependabot PR existed; constructed from first_patched_version 8.5.23 (highest across the batch). Added a pnpm.overrides entry and regenerated the lockfile with pnpm install --lockfile-only. Two resolutions existed before (8.4.31 and 8.5.15, same major); both now converge on 8.5.28, satisfying >= 8.5.23 for all four advisories. Companion-file scan (Dockerfiles, .nvmrc, go.mod, CI workflow YAML, etc. hardcoding 8.4.31) found no hits.

Risk

Low. Lockfile-only transitive dependency bump within the same major version line, resolves all 4 batched advisories at once. Group max severity high; Tier 1 / 90-day SLA.

---

[spur-vuln-reviewer]

Escalating: Gate 3 (diff equivalence) mechanically FAILed. gate3-check.sh: GATE3 FAIL target=postcss manifest=pnpm-lock.yaml pr_version=? required=8.5.23 alerts=60,90,91,101 extra_files=1 state=open. Detail: the helper has no extraction rule for ecosystem=npm manifest basename=pnpm-lock.yaml, so it could not extract the new postcss version from the diff, and flagged package.json as a file outside {manifest, lockfile} (which is actually the expected direct-dependency file for an npm/pnpm version bump). This looks like a tooling gap in gate3-check.sh (no pnpm-lock.yaml parser) rather than a real diff deviation, but per the review contract a mechanical Gate 3 FAIL is never re-derived or second-guessed by the reviewer. Required version per max open Dependabot alert(s) 60,90,91,101: 8.5.23. Not merged. A human must review this. This reviewer will not act on this PR again. [[spur-vuln-reviewer: escalated diff-mismatch-constructed]]