fix(deps): pin esbuild >=0.28.1 to clear GHSA-gv7w-rqvm-qjhr / GHSA-g7r4-m6w7-qqqr

esbuild resolved transitively via vitest>vite at 0.27.7, which is affected by:
- GHSA-gv7w-rqvm-qjhr (high): missing binary integrity verification in the Deno
  module enables RCE via NPM_CONFIG_REGISTRY
- GHSA-g7r4-m6w7-qqqr (low): arbitrary file read via the dev server on Windows

Both are fixed in 0.28.1. Add an `overrides.esbuild` pin so the transitive dep
resolves to the patched line. Dev-only (build/test toolchain); no runtime or
published-artifact impact. Build + full suite (2501 passing) verified green.

Author: neil