Published npm-shrinkwrap.json pins npm@11.19.0 with vulnerable tar@7.5.19

## Summary

Published `@salesforce/cli` packages include an `npm-shrinkwrap.json` that pins `npm@11.19.0`. That npm release bundles `tar@7.5.19`, which is affected by:

- GHSA-r292-9mhp-454m
- CVE-2026-73566
- Patched in `tar@7.5.21`

`npm@11.19.1` bundles the fixed `tar@7.5.22`.

## Affected releases

I confirmed the following published CLI releases contain the same vulnerable dependency chain:

- `@salesforce/cli@2.149.9`
- `@salesforce/cli@2.150.6` (current `latest`)
- `@salesforce/cli@2.151.6` (current `latest-rc`)

Dependency path:

```text
@salesforce/cli
└── npm@11.19.0
└── tar@7.5.19
```

## Consumer impact

Dependabot reports this as a high-severity runtime vulnerability. Consumers cannot cleanly remediate it themselves because the published CLI shrinkwrap dictates the nested npm dependency.

I tested the following approaches:

`npm update npm`
Root-level npm overrides
Overrides scoped beneath @salesforce/cli
Adding npm@11.19.1 as a direct dependency
Manually updating the consuming repository's package-lock.json
None fixes a clean installation. npm ci follows the CLI's published shrinkwrap and reinstalls npm@11.19.0 and tar@7.5.19. A manual lockfile edit can make dependency scanning appear fixed while leaving the installed package vulnerable.

## Requested fix
Please update the CLI's generated shrinkwrap to use npm@11.19.1 or newer and publish a new @salesforce/cli release.

Expected dependency path:

Thank you!

Start by locating the generation process for the published npm-shrinkwrap.json and inspect how npm@11.19.0 enters the @salesforce/cli package. Reproduce a clean installation with npm ci, update the generated dependency to npm@11.19.1 or newer, and verify that tar is no longer 7.5.19 before publishing a new CLI release.

Written by the indexing model from the issue text.