fix(security): bump form-data/vite (2 HIGH) + env-harden workflow template-injection + allowlist guarded workflow_run (#3949)

Remediate the real findings the now-functional osv-scanner and zizmor gates
surfaced on release/v3.8.26.

Deps (osv-scanner, 2 HIGH -> 0):
- form-data 4.0.5 -> ^4.0.6 (GHSA-hmw2-7cc7-3qxx, transitive via axios)
- vite 8.0.5 -> ^8.0.16 (GHSA-fx2h-pf6j-xcff HIGH + GHSA-v6wh-96g9-6wx3
  MODERATE; dev-only via vitest/@vitejs/plugin-react/fumadocs-mdx)
Applied via package.json overrides of existing deps (no new allowlist entry
needed). vulnCount 13 -> 10; build:cli + vitest MCP suite (16 files/187 tests)
green post-bump.

Workflows (zizmor, 195 -> 187):
- env-harden 7 template-injection findings by moving each ${{ ... }} into env:
  and referencing "$VAR" in the script (GitHub-documented mitigation):
  ci.yml i18n; electron-release.yml validate/build/release steps.
- allowlist 1 dangerous-triggers FP: deploy-vps.yml on:workflow_run is guarded
  on conclusion=='success' and deploys via SSH without checking out untrusted
  code. Added .zizmor.yml rules.dangerous-triggers.ignore with justification.

Tighten baselines to the improved state (direction: down): vulnCount 13 -> 10,
zizmorFindings 195 -> 187. secretFindings (3) and bundleSize (5601) unchanged.

package.json

@@ -330,6 +330,8 @@
     "postcss": "^8.5.14",
     "ip-address": "10.2.0",
     "qs": "^6.15.2",
-    "uuid": "^14.0.0"
+    "uuid": "^14.0.0",
+    "form-data": "^4.0.6",
+    "vite": "^8.0.16"
   }
 }