fix(template): refresh Next.js nanoid lock resolution

[rogerchappel]

Summary

• refresh the generated Next.js template lockfile so nanoid resolves to 3.3.18
• enforce a deterministic nanoid >=3.3.17 invariant in the normal template test
• document the reviewed procedure for refreshing a transitive template dependency

Commits

• e073145 fix(template): refresh nanoid lock resolution
• b657ab6 test(template): enforce safe nanoid baseline
• e4a6d5b docs: document template lock refreshes

Verification

rm -rf node_modules
corepack pnpm install --frozen-lockfile
corepack pnpm run release:check
git diff --check

The release check exercised the generated next-app through npm ci --ignore-scripts, ESLint, a production Next.js build, npm audit --omit=dev --audit-level=high (0 production vulnerabilities), scripts/validate.sh, and package smoke.

Closes the time-dependent template lock drift identified at origin/main b487d49.