fix: keep the validate and release gates green

- refresh dependency overrides so the audit gate passes again
  (protobufjs 7.6.4 -> 7.6.6, undici 8.5.0 -> 8.10.2, new
  brace-expansion override 5.0.9). npm run validate is green again:
  typecheck, 1229/1230 tests, 0 vulnerabilities, pack clean.
- promote the 0.22.0-evandro.1 changelog section from "###" to "##" so
  .github/workflows/release.yml can build release notes for the tag.
  The previous Release run failed with "CHANGELOG.md has no section for
  0.22.0-evandro.1".
- record both fixes under "## Unreleased".

package.json

@@ -81,22 +81,24 @@
     "typescript": "latest"
   },
   "overrides": {
-    "protobufjs": "7.6.4",
-    "undici": "8.5.0",
+    "protobufjs": "7.6.6",
+    "undici": "8.10.2",
+    "brace-expansion": "5.0.9",
     "ws": "8.21.0",
     "@earendil-works/pi-coding-agent": {
-      "protobufjs": "7.6.4",
-      "undici": "8.5.0",
+      "protobufjs": "7.6.6",
+      "undici": "8.10.2",
+      "brace-expansion": "5.0.9",
       "ws": "8.21.0",
       "@google/genai": {
-        "protobufjs": "7.6.4",
+        "protobufjs": "7.6.6",
         "ws": "8.21.0"
       },
       "@earendil-works/pi-ai": {
-        "protobufjs": "7.6.4",
+        "protobufjs": "7.6.6",
         "ws": "8.21.0",
         "@google/genai": {
-          "protobufjs": "7.6.4",
+          "protobufjs": "7.6.6",
           "ws": "8.21.0"
         }
       }