security(deps): resolve sharp 0.35.5 in all four sites

GHSA-wq5f-xc86-pv6w (CVE-2026-96889, librsvg bundled in sharp) was
published today and stopped the 0.6.6 binary release at its live
advisory audit. The lockfile delta is sharp and its @img platform
packages only; osv-scanner is clean on every tracked lockfile and all
four sites build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: ebursztein

CHANGELOG.md

@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+- All four sites resolve `sharp` 0.35.5 instead of 0.35.4
+  (GHSA-wq5f-xc86-pv6w: vulnerable bundled librsvg, CVE-2026-96889).
+
 - All four sites resolve `smol-toml` 1.9.0 instead of 1.7.1
   (GHSA-r4xh-jqrq-34v2: quadratic-time parse on long documents).