bug(opencode): brace-expansion version is affected by ReDoS advisories (CVE-2026-14257)

Description

The opencode-ai npm package distribution bundles brace-expansion@5.0.7 in its dependencies. brace-expansion <= 5.0.7 is affected by a HIGH severity ReDoS vulnerability (CVE-2026-14257).

Steps to Reproduce

1. Install opencode-ai@1.1.10 via npm install -g opencode-ai@1.1.10.
2. Run a container vulnerability scanner (e.g., Trivy) on /usr/local/lib/node_modules/opencode-ai/.
3. Scanner flags HIGH vulnerability CVE-2026-14257 in brace-expansion@5.0.7 (fixed in >=5.0.8 / >=2.0.1).

Expected Behavior

opencode-ai release builds should bundle brace-expansion version >=5.0.8 or >=2.0.1.

Environment

• OpenCode Version: 1.1.10
• OS: Linux (Debian bookworm)
• Terminal: bash

Additional Context

Related to dependency ReDoS advisories (similar to #34181). Bumping brace-expansion to >=5.0.8 in package release manifests closes this vulnerability for container builds.