fix(dev-1693): bump next to 15.5.24

[spur-vuln-author]

Context

next is resolved at 15.3.1 in pnpm-lock.yaml (auto-installed peer of monocle-nextjs, not a direct dependency in any package.json). 30 open Dependabot advisories against this package/manifest (GHSA-2xp9-vwfh-vxw4 and 29 others — see the footer and DEV-1693 for the full list) require versions up to 15.5.24. No Dependabot PR exists for this finding. Bumped via a root pnpm.overrides entry (next: ^15.5.24) since next is a transitive/peer dependency, then regenerated the lockfile with pnpm install --lockfile-only. Resolved to 15.5.27, which satisfies every advisory's first_patched_version in the batch.

Three additional low-severity next advisories on this same manifest (GHSA-vfv6-92ff-j949, GHSA-3g8h-86w9-wvmq, GHSA-r2fc-ccr8-96c4) are tracked separately as risk-accept-proposal in DEV-1694 and are incidentally resolved by this same bump.

Test evidence

No Dependabot PR existed to replay; constructed from first_patched_version 15.5.24 (the highest across the batch). CI will run on this PR (Linting and Changeset Checks, Unit Tests, CodeQL, Branch name check).

Risk

Medium. This is a dependency-lockfile-only change via a pnpm.overrides entry, scoped to the next package. No source files are touched. next is a peer dependency of monocle-nextjs's build/test; CI's build and test steps exercise that path.

---

[spur-vuln-reviewer]

Verified: diff scope limited to package.json + pnpm-lock.yaml (gate3-check.sh PASS, target=next pr_version=15.5.27 meets required=15.5.24, alerts 4,8,9,10,22,23,24,26,28,43,45,55,56,57,58,59,61,62,63,64,65,66,67,71,92,93,94,95,96,97,98,122,123, no extra files/deps). No .github/ changes. CI green (Linting, CodeQL x2, Unit Tests all SUCCESS). All commits authored by spur-vuln-author[bot].

[spur-vuln-reviewer]

merge-conflict: this PR was approved and passed all gates, but merging PR #78 (also pnpm-lock.yaml) ahead of it in this same pass changed main such that mergeStateStatus is now DIRTY (merge conflict). The approval stands; not merged. A human must review this (rebase/regenerate the lockfile). This reviewer will not act on this PR again.

[[spur-vuln-reviewer: escalated merge-conflict]]