Changes touching this path

• the override was holding esbuild on the vulnerable branch: site npm audit goes to zero, in range (#916) Four advisories, all four in-range, and the interesting one was ours. `npm audit fix` cleared js-yaml 4.3.0 -> 4.3.1, nanoid 3.3.16 -> 3.3.18 and postcss 8.5.19 -> 8.5.26, then went on reporting esbuild vulnerable with a fix supposedly available via itself — because site/package.json OWN overrides block pinned `esbuild: ^0.27.0`, the vulnerable branch. Every declarer accepts `^0.28.0` (vite 8 peer `^0.27.0 || ^0.28.0`, vite 7 the same, unplugin `*`), so moving the override to `^0.28.2` violates no constraint and needs no resolver force. That override block is how the last three of these were fixed (path-to-regexp, undici); it is the mechanism, and it needs re-reading at each bump or it becomes the thing holding the vulnerability in place — which is what it was doing here. The lockfile diff is 30 entries and all of them are these four packages: esbuild and its 26 per-platform binaries, plus js-yaml, nanoid, postcss. No package added, none removed, no unrelated resolver churn, package.json otherwise untouched. `npm ci` succeeds in site/ now, so the #894 install-repair hazard did not ride along. Verified: `npm audit` 0 vulnerabilities, `npm test` 75 passed | 23 skipped, `npm run build` typechecks and prerenders all 8 pages. Reachability, since the ticket asked whether the two highs are urgent: all four are build-time only — esbuild and postcss through vite, nanoid through postcss, js-yaml through xmlbuilder2 inside @tanstack/start-plugin-core. None can reach a served response. No audit gate: it is clean today, but its trigger is a third party publishing an advisory, so a gate breaks unrelated builds on a schedule nobody here sets — the #642 permanently-yellow objection with the yellow arriving later. sdk/ is worse (7, one needing a vitest major) and is filed as #951. f77ce77e · dbf3dbe6…

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.