Update the root protobufjs resolution from 7.2.5 to 7.5.5 and refresh
pnpm-lock.yaml so all workspace audit targets resolve to the patched
version. This clears the critical pnpm audit advisory that caused the
Buck audit targets to fail in CI.

Also improve the shared pnpm audit wrapper to report failing advisories
from the JSON audit result directly. The previous wrapper reran
`pnpm audit` without JSON after detecting vulnerabilities, which could
hang until Buck's 10 minute test timeout and leave CI with empty audit
stdout/stderr. The wrapper now captures stderr for parse failures and
prints concise advisory details for vulnerabilities at or above the
configured audit level.

Validation:
- pnpm audit metadata reports critical: 0
- run_audit.py passes at --audit-level critical
- all seven previously failing Buck audit targets pass