fix(sandbox): patch bundled runtime dependencies

[iamjr15]

Summary

• advances the frozen Debian package snapshot to include the fixed Bookworm NSS build
• updates the Expo template and document runtime away from vulnerable archive/glob dependencies
• adds one integrity-locked security overlay for dependency trees embedded inside npm, pnpm, and code-server
• verifies the resolved NSS and embedded package versions in the protected snapshot smoke test

Context

The first Node 24 snapshot run built successfully but Trivy correctly blocked publication. No Daytona snapshot was created. The scan found fixed vulnerabilities in Debian NSS, the Expo/document locks, and dependency trees that npm, pnpm, and code-server bundle internally and therefore cannot receive ordinary top-level overrides.

Decisions

Decision	Choice	Reasoning
Debian fix	Frozen 2026-07-22 snapshot	This is after libnss3 2:3.87.1-1+deb12u3 first entered Debian Security on July 21
Document runtime	Upgrade archiver to 8.0.0 and unzipper to 0.12.5	Removes the old glob/minimatch chain while preserving ExcelJS behavior
Expo	Minimal pnpm override and lock update to brace-expansion 5.0.8	Keeps the generated app graph stable and patched
Embedded CLIs/editor	One lockfile-backed runtime security overlay	npm, pnpm, and code-server ship nested dependency trees that package-manager overrides do not replace
Image layers	Patch in the same layer that installs/extracts upstream bundles	Vulnerable copies never survive in a committed image layer
Scanner input	Remove the package-manager install lock from the runtime image	The source lock honestly records npm's upstream bundle; the final image contains only patched files

Verification

• original protected image build passed; publication was blocked at Trivy as designed
• full lint, typecheck, and production build pass under Node 24.18.0
• architecture boundaries, dead-code scan, actionlint, and shellcheck pass
• Trivy Docker configuration scan: 0 findings
• Trivy lock scans for Expo, document runtime, and security overlay: 0 findings
• npm audits for document runtime and security overlay: 0 findings
• Expo production lock audit: 0 findings
• ExcelJS workbook write/read round trip passes with the upgraded archive stack
• patched npm, pnpm, and code-server package APIs and exact versions verified locally
• protected final-image vulnerability/secret scan and runtime smoke test after merge
• Daytona snapshot publication and direct production QA after promotion

The repository still contains exactly one SQL migration file. This PR has no database or production data change. No Linear issue or plan document is associated with this production QA fix.