chore: remove redundant glob ^11.0.4 override (#940)

[frano-m]

Summary

• Remove the overrides: { glob: "^11.0.4" } block from package.json — it was added in chore: bump nextjs version to fix vulnerabilities (#704) #705 (Dec 2025) to silence audit findings from Next 14's transitive deps, and the dep graph no longer produces those findings under Next 16.
• Refresh package-lock.json to the override-free resolution.
• Add a short README subsection under "Consumer setup for Next.js 16" telling consumers that carry the same override to remove it.

Audit findings (npm audit shows zero glob-related vulns at v7/v11/v13)

State	docgen plugin glob	Jest 29 glob	Total npm audit vulns
With override (current main)	v11.1.0 (forced down from declared ^13.0.1)	v11.1.0 (forced up from declared ^7.1.3)	7 moderate
Without override (this PR)	v13.0.6 (matches declared range)	v7.2.3 (matches declared range)	6 moderate

Removing the override:

• Aligns @joshwooding/vite-plugin-react-docgen-typescript with its declared glob ^13.0.1 (the override was silently downgrading it).
• Returns Jest 29's transitive glob to its declared ^7.1.3 — what Jest 29 was designed against.
• Reduces audit count by 1 (the v11 forcing was adding a moderate finding).
• Reintroduces a npm warn deprecated inflight@1.0.6 warning during install (Jest 29 → glob@7 → inflight). Cosmetic; not a CI failure.

Verification

• npx tsc --noEmit — clean
• npm test — 447 tests pass
• Smoke test in data-biosphere on fran/x-nextjs-test with local tarball: npm run build:anvil-cmg succeeded end-to-end (all pages prerendered, next-sitemap generated).

Closes #940.

Test plan

• CI green
• Reviewer confirms npm audit doesn't surface new glob-related findings after this lands

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR removes a now-redundant glob npm override from package.json (originally added to address Next.js 14-era audit findings) and refreshes the lockfile to reflect the natural, override-free dependency resolution under Next.js 16. It also updates the README to guide downstream consumers who may still carry the old override.

Changes:

• Remove overrides: { glob: "^11.0.4" } from package.json.
• Regenerate package-lock.json to reflect override-free glob resolution (notably allowing Jest’s transitive glob@7.x again and allowing newer consumers to use glob@13.x).
• Add README guidance for consumers to remove the stale override.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
README.md	Adds consumer guidance on removing the stale glob override (and expected install warnings).
package.json	Removes the glob override block.
package-lock.json	Updates the resolved dependency graph after removing the override.