Fix critical Handlebars CVEs from daily vulnerability scan

[kylos101]

Summary

The latest scheduled main build reported four distinct CRITICAL npm advisories across the shared Yarn dependency graph. Open draft PRs #21633 and #21634 already address proxy-addr and shell-quote; this PR fixes the two newly reported Handlebars advisories without duplicating that work.

Package	From	To	Advisories
handlebars	4.7.9	4.7.10	GHSA-8r5x-fm3f-whwj / CVE-2026-106446; GHSA-p8wg-vrv2-v86f / CVE-2026-106445

The affected artifacts include the dashboard, database, supervisor frontend, workspace manager bridge, server image, and generated TypeScript API packages. They inherit Handlebars from the root Yarn resolution and lockfile.

Validation

• yarn install --pure-lockfile --ignore-scripts --force --non-interactive
• Verified installed Handlebars version is 4.7.10
• Grype scan of yarn.lock: zero matches for both targeted advisories and zero remaining Handlebars matches
• pre-commit run --files package.json yarn.lock
• git diff --check