pnpm: `stage download` writes outside its destination directory via manifest name/version traversal (CVE-2026-55700) | HOL Guard CVE