Change editor assets to the cache directory - #154

…ories

Resolves 29 Dependabot advisories in the dev dependency tree. None of
these packages ship in the iOS/Android app bundle -- they are build,
lint, and local-WP (`@wordpress/env`) tooling.

In-range bumps:
- `vite` 8.0.5 -> 8.2.1 (direct devDep; floor raised to `^8.0.16`) #134 #135
- `shell-quote` -> 1.10.0 (critical #133) #165
- `fast-uri` -> 3.1.5 #163 #164 #179 #206 #207
- `js-yaml` -> 3.15.1 / 4.3.1 #157 #158 #167 #168 #200 #201
- `brace-expansion` #160 #166, `immutable` #161 #162, `tmp` #131,
  `fast-xml-builder` #122 #123, `simple-git` #119,
  `@babel/plugin-transform-modules-systemjs` #126

Scoped `overrides` (parents exact-pinned the vulnerable version):
- `ws` -> 8.21.0, keeping 7.5.13 for `react-devtools-core` #138 #153
- `qs` -> 6.15.2 under `@wordpress/env` #130
- `minimatch` -> 9.0.9 under `@typescript-eslint/typescript-estree` #65
- `@babel/core` -> 7.29.7 under `@wordpress/babel-preset-default` #154

Not addressed here: `electron` (33 alerts) and its bundled `got` (#33)
are pinned by `react-devtools@7.0.1` -- already the latest, and npm's
only "fix" is a breaking downgrade to `react-devtools@1.0.5`.
Runtime-scope advisories (`seroval`, `nanoid`, `postcss`, `showdown`,
`uuid`) are out of scope for a dev-only bump.

Verified: `npm run test:unit` (202 passing) and `npm run build` green.