fix(deps): bump brace-expansion 5.0.6 -> 5.0.9 to clear the audit gate

CI's `npm audit --audit-level=moderate` step went red on three high-severity
brace-expansion DoS advisories (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg,
GHSA-rgw5-rvv9-x895). Not introduced here — the advisories postdate main's last
green run on 2026-06-16, so main is red on this today too; it surfaced on this
PR because this is the first run since.

Dev-only transitive path: c8 -> test-exclude -> minimatch -> brace-expansion.
`npm audit fix` resolves it inside the existing minimatch range, so the delta is
five lockfile lines and one package. Audit now reports 0 vulnerabilities.

Verify: 383 tests across all four packages, 0 fail, exit 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mcp-tool-shop