chore(security): patch vulnerable deps and harden CI

[charlesvien]

Problem

The desktop app's dependency tree carries known CVEs (critical: protobufjs, simple-git, tar; high: axios) flagged during the monorepo import review.

Note: Temporarily removing react-doctor due to poor security patterns that workflow has, will add it back in monorepo properly in a follow-up PR.

Changes

• Bump the CVE-flagged dependencies to patched versions: simple-git ^3.32.3 and tar ^7.5.19 as direct floors, plus protobufjs 7.6.5 and axios 1.18.1 as transitive overrides. Every resolved version is well over the 7-day minimumReleaseAge and clears its advisories.
• react-doctor.yml: install react-doctor from a pinned, integrity-locked lockfile (.github/scripts/react-doctor/) via npm ci instead of npx --yes (no unverified runtime fetch). pull-requests: write is scoped to the single job that posts the sticky comment instead of the whole workflow.
• encryption.ts: pass { authTagLength: 16 } to createDecipheriv so a shorter forged tag cannot be accepted (semgrep gcm-no-tag-length).

How did you test this?

• pnpm install --frozen-lockfile passes on the regenerated lockfile.
• pnpm audit shows the four flagged packages (protobufjs, simple-git, tar, axios) clear of advisories.
• semgrep universal security packs over the tree report no ERROR findings after the gcm change.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 017884b.}

[greptile-apps]

Prompt To Fix All With AI

### Issue 1
.github/scripts/react-doctor/package.json:1
**Runner manifests bypass CI**

Changes limited to this manifest or its lockfile do not match the React Doctor workflow's path filters, so a broken lockfile or incompatible update is not validated until a later source-code pull request triggers `npm ci`.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "pin react-doctor and scope its write per..." | Re-trigger Greptile}