fix(deps): override patched esbuild

[aantenore]

Summary

• force the dependency graph to patched esbuild 0.28.1 through the pnpm workspace policy
• keep Vite, Vitest, tsup, and direct dependency versions unchanged

Verification

• formatting, lint, and TypeScript checks
• 125 unit tests with coverage
• library and demo builds
• package surface and installed-package smoke checks
• 30 browser tests across Chromium, Firefox, and WebKit
• pnpm audit: zero vulnerabilities

Boundary

The override can be removed once every upstream constraint resolves to a patched esbuild release without policy intervention.