fix(docs): force transitive sharp up to patched 0.35.3

sharp <0.35.0 inherits four libvips CVEs (GHSA-f88m-g3jw-g9cj). It comes
in as an optional dependency of next, which still declares ^0.34.5 on its
current release, so only an override reaches the fixed line. Brings
libvips 8.18.3 via @img/sharp-libvips-* 1.3.2.

docs/pnpm-workspace.yaml

@@ -6,6 +6,7 @@ allowBuilds:
 # release — fixes GHSA-qx2v-qp2m-jg93 / CVE-2026-41305 (vulnerable < 8.5.10).
 overrides:
   'postcss@<8.5.10': '^8.5.15'
+  'sharp@<0.35.0': '^0.35.3'
 minimumReleaseAgeExclude:
   - '@mermaid-js/parser@1.2.0'
   - mermaid@11.16.0