fix(deps): resolve all Dependabot security alerts

[privaloops]

Summary

• Replace watch (abandoned) with chokidar-cli to fix merge prototype pollution (via exec-sh)
• Add npm overrides for transitive vulnerabilities:
  • serve → ajv@8.18.0, minimatch@3.1.4 (via serve-handler)
  • conventional-changelog-cli → git-raw-commits@5.0.1, @conventional-changelog/git-client@^2.0.0
• Combined with the 6 Dependabot PRs already merged (chore(deps-dev): bump brace-expansion from 1.1.11 to 1.1.12 #85-chore(deps-dev): bump cross-spawn from 7.0.3 to 7.0.6 #90), this brings npm audit to 0 vulnerabilities

What was changed

Before	After	Reason
watch@1.0.2	chokidar-cli@3.0.0	watch → exec-sh → merge@1.2.1 (prototype pollution)
ajv@8.12.0 (via serve)	ajv@8.18.0 (override)	ReDoS with $data option
minimatch@3.1.2 (via serve-handler)	minimatch@3.1.4 (override)	Multiple ReDoS vulnerabilities
@conventional-changelog/git-client@1.x	@conventional-changelog/git-client@2.x (override)	Argument injection

Test plan

• npm audit → 0 vulnerabilities
• npm run build → pass
• npm run lint → pass
• npm run test:unit → 28 tests pass
• conventional-changelog → still works