chore(deps): hard-pin the graphile v5 stack via overrides

[pyramation]

Summary

Makes benjie's graphile v5 stack a hard, exact pin across the workspace instead of caret ranges scattered across package manifests. Graphile is the one third-party family we deliberately don't want floating: a minor bump ripples through PostGraphile plugins/codegen, and the constructive-hub update automation re-resolves lockfiles under a release-age gate, so an unpinned graphile release landing hours before a run causes non-deterministic resolution. Pinning at the workspace root (pnpm.overrides) is the single enforcement point — it wins over every package's own range, so the whole tree resolves to one known-good set regardless of what individual manifests declare.

Pins are set to the versions already resolved today, so this is enforcement, not an upgrade — the only lockfile changes are the overrides: snapshot and the effective specifiers flipping ^x → x (verified: no unrelated dep churn). These move only when we deliberately bump one and re-pin, under review.

 "pnpm": {
   "overrides": {
+    "grafast": "1.1.1",
+    "grafserv": "1.0.1",
+    "graphile-build": "5.1.1",
+    "graphile-build-pg": "5.1.3",
+    "graphile-config": "1.1.0",
+    "graphile-utils": "5.0.3",
+    "postgraphile": "5.1.3",
+    "pg-sql2": "5.0.1",
+    "pg-introspection": "1.0.1",
+    "tamedevil": "0.1.1",
+    "@dataplan/pg": "1.1.1",
     "@dataplan/json": "1.0.1",
+    "@graphile/lru": "5.0.0",
+    "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
     "graphql": "16.13.0",
     "@smithy/node-http-handler": "<4.5.0"
   }

Companion to constructive-db#2808, which whitelists this same graphile set from the release-age wait (constructive-db pulls it transitively via our @constructive-io/* packages, which already fix the exact versions).

Validation

pnpm install --no-frozen-lockfile with the age gate active resolves cleanly; policy:check passes; lockfile diff is limited to the overrides snapshot + specifier normalization.

Link to Devin session: https://app.devin.ai/sessions/ef0c67d2f7bd4cb3b157dbd4f2e7c533
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring