[sec-check] picomatch 4.0.3 nested under cspell-glob: method injection + ReDoS (GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj)

## Security Finding

**Severity**: medium
**Type**: CVE / transitive-dependency

`package-lock.json` pins `picomatch@4.0.3` nested under `cspell-glob` (`node_modules/cspell-glob/node_modules/picomatch`). That range is affected by:

- GHSA-3v7f-55p6-f55p — Method Injection in POSIX Character Classes causes incorrect glob matching (fixed in 4.0.4)
- GHSA-c2c7-rcm5-vvqj — ReDoS via extglob quantifiers (fixed in 4.0.4)

## Impact

Build-time / dev-only exposure: the vulnerable copy is only reachable through the cspell spell-check chain (`cspell-glob`), not shipped to the site. A maliciously crafted glob input during a spell-check run could trigger incorrect matches or CPU exhaustion.

## Recommendation

Add a scoped npm override forcing the nested copy to ^4.0.4:

```json
"overrides": {
"cspell-glob": {
"picomatch": "^4.0.4"
}
}
```

Fix PR: #107 (supersedes stalled #87).

---
*Filed by sec-check agent (ACMM L6 — full mode)*

Start with package-lock.json and the cspell-glob nested dependency at node_modules/cspell-glob/node_modules/picomatch, then inspect the package manifest's overrides section. Done means the cspell-glob dependency resolves picomatch to ^4.0.4 and the lockfile reflects that resolution; note that PR #107 already supersedes this issue.

Written by the indexing model from the issue text.