Override vulnerable shell-quote

[bgentry]

Dependabot cannot resolve the high-severity
shell-quote advisory because concurrently@10.0.3 pins vulnerable
shell-quote@1.8.4; its only automatic path would downgrade
concurrently.

This adds a root override for the compatible patched release line, which
resolves shell-quote@1.10.0 without changing concurrently. The lockfile
changes only that package's version, registry URL, and SHA-512 integrity.

The published artifacts and upstream source were reviewed before executing
project code. The patched package retains the same maintainers, publisher,
repository, signing key, license, and runtime surface, with no install hooks,
bins, native code, network access, or process execution.

[bgentry]

🤖 Codex review: Security and compatibility review looks good to me.

Reviewed head: 94fbf22f5a0ceb32deadd6013a03577f789f5f13

Security and supply-chain scope

• Compared the published shell-quote 1.8.4, 1.9.0, and 1.10.0
  artifacts and upstream source. Registry SHA-512 values match the
  lockfile/npm metadata, and maintainer, publisher, repository, signing key,
  license, and Node engine remain stable.
• Verified the signed fix for GHSA-395f-4hp3-45gv replaces both quadratic
  parse() reducers with linear append operations. Version 1.10.0 retains
  that fix; its additional parser changes are reviewed, verified upstream
  commits with no unexpected expansion of trust.
• Found no new install/build hooks, bins, dependencies, native/WASM payloads,
  network or telemetry code, credential/environment access, filesystem
  writes, process spawning, dynamic evaluation, or obfuscation.
• Structurally checked the manifest and lockfile diff. The override changes
  exactly one locked package from 1.8.4 to 1.10.0, with no added/removed
  packages, lifecycle hooks, bins, native packages, non-registry URLs,
  non-SHA-512 integrity, or same-version checksum rewrites.

Compatibility and reachability

• This is a development-only transitive dependency through
  concurrently@10.0.3. River's path imports quote(), not the advisory's
  vulnerable parse() function; reviewed quote() changes are compatible
  with concurrently's placeholder handling.
• A clean lifecycle-disabled install resolves concurrently@10.0.3 to
  shell-quote@1.10.0 as intended.
• Self-verification passed: 205 tests, lint, production build, Storybook
  build, installed dependency-tree check, concurrently CLI and placeholder
  argument-quoting smoke checks, and a 64,000-token parser regression check
  completing in 16 ms.

Residual risk and verdict

The override is intentionally necessary until concurrently relaxes its
exact shell-quote@1.8.4 pin; it should be removed once upstream publishes a
compatible dependency range. I found no blocking security or compatibility
issue in this remediation.