[gmethvin]

Summary

• Axios 1.13.6, csv-parse 6.2.1, and Zod 4.3.6 have published security fixes. This moves them to axios 1.21.0, csv-parse 7.0.3, and Zod 4.6.7.
• Patched copies of follow-redirects, brace-expansion, js-yaml, picomatch, browserslist, Babel, and humanfs already sit inside the ranges of axios, Jest, and ESLint. The lockfile takes those versions without pnpm overrides.
• glob, minimatch, and deepmerge remain. The glob and minimatch fixes are major bumps, and deepmerge has no patched release.

Test plan

• pnpm exec jest --testPathPatterns=unit (292 passed)
• pnpm audit reports no high or critical findings. Four dev-only findings remain: glob and minimatch (moderate; minimatch is on two paths) and deepmerge (low, no patched release).