S0306-cli-ci-dependabot-updates: resolve undici-types past its provenance gap so npm updates run again

[NSchatz]

What this fixes

Dependency updating in this repo has been dead since pnpm-workspace.yaml
landed, while the workflow reported green. Every npm candidate the updater
tried was refused, and the refusal was reported against whichever package was
being bumped rather than against its cause.

The cause is one transitive package. pnpm@10.34.5 with
trustPolicy: "no-downgrade" refuses undici-types@6.21.0:

ERR_PNPM_TRUST_DOWNGRADE  High-risk trust downgrade for "undici-types@6.21.0" (possible package takeover)
This error happened while installing the dependencies of @types/node@22.20.2

Trust checks are based solely on publish date, not semver. A package cannot be
installed if any earlier-published version had stronger trust evidence. Earlier
versions had provenance attestation, but this version has no trust evidence.

undici-types carried an SLSA provenance attestation from 6.13.0 through
6.19.2, published none from 6.19.3 through 7.0.0, and carries one again
from 6.23.0 on in the 6.x line.

Every @types/node from 22.4.0 up declares a range whose newest member falls
inside that gap: ~6.19.2 resolves to 6.19.8, then ~6.19.8, ~6.20.0 and
~6.21.0. Measured rather than inferred, under the same two settings:
@types/node@22.3.0 installs clean, and @types/node@22.7.9 fails on
undici-types@6.19.8. So there is no version of @types/node this package
could move forward to that resolves, and a range move cannot be the fix.

The refusal also fails the whole install, which is what made the three
@cosyte/* bumps unresolvable. Verified: bumping @cosyte/transform,
@cosyte/x12 and @cosyte/mllp to the versions the updater wants fails on
undici-types and on nothing of their own, and all three carry provenance on
every version they have published.

The change

One pnpm.overrides entry moving undici-types forward to 6.28.1, the
newest 6.x release carrying the attestation again. The key names the evidence
gap itself, so the entry matches nothing once @types/node declares a range
past it and can be removed by hand then.

Nothing is weakened. pnpm-workspace.yaml, .npmrc and
.github/dependabot.yml are untouched, no ignore entry was added because no
dependency needed one, and the only resolved version that moves is
undici-types, forward.

Checks

install --frozen-lockfile, typecheck, lint, test (777 tests, 41 files),
build and check:agent-notes all pass on the committed lockfile.
engines.node is unchanged at >=22.0.0 <26.0.0.

Spec: pipeline/active/S0306-cli-ci-dependabot-updates/spec.md in the meta
repo, with the per-criterion evidence in the notes.md beside it.