chore(deps): combine open Renovate dependency updates

.github/zizmor.yml

@@ -16,3 +16,10 @@ rules:
         ignore:
             - "cache-clear.yml"
             - "stale-issues.yml"
+
+    ref-version-mismatch:
+        # The zizmor gate is deliberately pinned to an untagged commit on
+        # anolilab/workflows main, so the "# main" comment cannot name a
+        # released version. Repin once that commit is covered by a release.
+        ignore:
+            - "zizmor.yml"

package.json

@@ -126,7 +126,7 @@
         "vite": "catalog:",
         "vitest": "catalog:"
     },
-    "packageManager": "pnpm@11.28.2",
+    "packageManager": "pnpm@11.28.3",
     "engines": {
         "node": ">=22.12.0 <=25.*"
     }