deps: held major upgrades (minimatch 10, esbuild 0.28)

[terraboops]

Majors deliberately held back during the 2026-08 maintenance sweep (PR #19).

Package	Current	Latest	Notes
minimatch	^9.0.9	10.2.6	Major; 9.0.9 already carries the brace-expansion hardening, so there's no security pressure
esbuild	^0.19.12	0.28.2	Its open advisory is about esbuild's dev server, which this repo never runs — used only as a build-time bundler in scripts/build.js. Not reachable, so low urgency

Reminder for whoever takes these: scripts/dist/*.cjs are committed and executed by the composite actions, so any bump must be accompanied by node scripts/build.js in the same PR.