chore(deps): remove qs@6.16.0 from minimumReleaseAgeExclude once naturally aged

[qnbs]

Context

PR #587 admits qs@6.16.0 early via a version-scoped minimumReleaseAgeExclude: qs@6.16.0 entry in pnpm-workspace.yaml, to remediate GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx ahead of this repo's normal 7-day minimumReleaseAge quarantine (10080 minutes). Same mechanism/precedent as the existing nanoid@3.3.18 exclusion (PR #362).

qs@6.16.0 was published 2026-08-29T23:50:15.803Z. It naturally clears the 7-day quarantine at 2026-09-05T23:50:15Z UTC.

Task

Once that timestamp has passed:

1. Remove qs@6.16.0 from minimumReleaseAgeExclude in pnpm-workspace.yaml (leave nanoid@3.3.18 untouched).
2. Confirm an ordinary frozen install (pnpm install --frozen-lockfile) still resolves qs@6.16.0 without the exclusion (i.e. the version has genuinely aged past the floor on its own).
3. Update the corresponding AUDIT.md override-table row to drop the release-age-exception language once the exclusion is removed.

This is explicitly not a prerequisite for merging #587 or any of the PRs currently in flight — it's a bounded follow-up so the temporary exception doesn't quietly become permanent.

Non-goals

• Do not touch the global minimumReleaseAge: 10080 setting.
• Do not remove or modify the nanoid@3.3.18 exclusion.
• Do not broaden this into a general dependency-governance redesign.