Deliver scoped UI dependency security remediation
Scoped delivery record for the dependency remediation implemented by !1179 (merged).
Parent program: #645
Done when the MR has a green required pipeline, fresh independent final-head review, explicit human approval, and resolved blocking discussions. The broader frontend-upgrade program remains open.