ci: point reusable workflow refs at renamed btravstack/tools repo

.github/actions/setup/action.yml

@@ -1,7 +1,7 @@
 name: "Setup Node.js and pnpm"
 description: "Setup Node.js and pnpm, install dependencies"
 
-# CI and Release call btravstack/config's reusable workflows, which do their own
+# CI and Release call the reusable workflows in btravstack/tools, which do their own
 # setup. This composite exists for Deploy Documentation, which runs its own
 # steps in this repo and needs the same toolchain.
 

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   ci:
-    uses: btravstack/config/.github/workflows/ci-reusable.yml@workflows-v1
+    uses: btravstack/tools/.github/workflows/ci-reusable.yml@workflows-v1
     with:
       # "" uses .node-version (the dev/primary version, currently 24.16.0).
       # 22.19 is the ROOT package's engines floor — the oldest Node this repo

.github/workflows/release.yml

@@ -17,6 +17,6 @@ jobs:
       contents: write
       pull-requests: write
       id-token: write
-    uses: btravstack/config/.github/workflows/release-reusable.yml@workflows-v1
+    uses: btravstack/tools/.github/workflows/release-reusable.yml@workflows-v1
     secrets:
       RELEASE_PAT: ${{ secrets.RELEASE_PAT }}

pnpm-workspace.yaml

@@ -97,6 +97,11 @@ overrides:
   # Pinning vitest's vite apart would mean an inline `vite` devDependency on the
   # library package for a purely transitive concern; not worth it.
   "vite@<6.4.3": "6.4.3"
+  # GHSA-2v37-7h3g-55p8 (High): nanoid custom generators can loop indefinitely
+  # when size is zero. Reaches us only through the docs build —
+  # docs > @btravstack/theme > vitepress > postcss > nanoid — never the shipped
+  # package. 3.3.18 is the first release patched for the widened range.
+  "nanoid@<3.3.18": "3.3.18"
 
 peerDependencyRules:
   ignoreMissing: