fix(security): bump form-data/vite (2 HIGH) + env-harden workflow template-injection + allowlist guarded workflow_run (#3949)

Remediate the real findings the now-functional osv-scanner and zizmor gates
surfaced on release/v3.8.26.

Deps (osv-scanner, 2 HIGH -> 0):
- form-data 4.0.5 -> ^4.0.6 (GHSA-hmw2-7cc7-3qxx, transitive via axios)
- vite 8.0.5 -> ^8.0.16 (GHSA-fx2h-pf6j-xcff HIGH + GHSA-v6wh-96g9-6wx3
  MODERATE; dev-only via vitest/@vitejs/plugin-react/fumadocs-mdx)
Applied via package.json overrides of existing deps (no new allowlist entry
needed). vulnCount 13 -> 10; build:cli + vitest MCP suite (16 files/187 tests)
green post-bump.

Workflows (zizmor, 195 -> 187):
- env-harden 7 template-injection findings by moving each ${{ ... }} into env:
  and referencing "$VAR" in the script (GitHub-documented mitigation):
  ci.yml i18n; electron-release.yml validate/build/release steps.
- allowlist 1 dangerous-triggers FP: deploy-vps.yml on:workflow_run is guarded
  on conclusion=='success' and deploys via SSH without checking out untrusted
  code. Added .zizmor.yml rules.dangerous-triggers.ignore with justification.

Tighten baselines to the improved state (direction: down): vulnCount 13 -> 10,
zizmorFindings 195 -> 187. secretFindings (3) and bundleSize (5601) unchanged.

.github/workflows/ci.yml

@@ -302,8 +302,14 @@ jobs:
           python-version: "3.12"
 
       - name: Validate ${{ matrix.lang }}
+        env:
+          # Pass the matrix value via env (never interpolate ${{ ... }} straight
+          # into the run: script body) so the shell receives a variable, not
+          # inlined text — zizmor template-injection mitigation. Named MATRIX_LANG
+          # to avoid clobbering the POSIX `LANG` locale variable.
+          MATRIX_LANG: ${{ matrix.lang }}
         run: |
-          python3 scripts/i18n/validate_translation.py quick -l '${{ matrix.lang }}' > result.txt
+          python3 scripts/i18n/validate_translation.py quick -l "$MATRIX_LANG" > result.txt
 
       - name: Upload result
         if: always()