cloudflare-workers: remove @puppeteer/browsers override once @cloudflare/puppeteer ships it

[JustMaris]

Tracking a deliberate transitive-dep override that should be reverted later. Filed here because drumandbytes/cloudflare-workers has issues disabled.

Context

cloudflare-workers#44 added to vault-worker/package.json:

"overrides": { "@puppeteer/browsers": "^3.2.2" }

Resolves cloudflare-workers Dependabot alert #69 (extract-zip symlink path traversal, GHSA-x7jf-2287-qcpf, high). extract-zip has no patched release — 2.0.1 (2020) is the last. @puppeteer/browsers@3.2.2 replaced extract-zip/tar-fs/proxy-agent with modern-tar, so overriding that transitive dep removes extract-zip from the tree.

@cloudflare/puppeteer@1.4.0 still pins @puppeteer/browsers@2.2.4 exactly. The override forces a major past what the parent declares — safe only because @puppeteer/browsers is reachable solely from the Node *Launcher modules, which the Worker entry (puppeteer-cloudflare) never loads.

When to close

When npm view @cloudflare/puppeteer@latest dependencies shows @puppeteer/browsers at 3.x (currently 2.2.4):

1. Bump @cloudflare/puppeteer in vault-worker
2. Delete the overrides block
3. Verify: npx tsc --noEmit, npx vitest run, npx wrangler deploy --dry-run