[github-actions]

What

Bumps every example to Nutrient Web SDK 1.25.0. It also fixes the two problems that stopped the update workflow from opening this PR itself.

• Unpublished audit overrides. pnpm audit --fix=override wrote deepmerge@^4.3.2 into examples/svelte-kit, but that version doesn't exist: the deepmerge advisory GHSA-gcqx-w48m-w2h4 has no patched release. The install after it failed and the bump stopped. run_pnpm_audit_fix now drops any override it just added that no published version matches, and logs it. If the registry lookup fails for any other reason, it keeps the override.
• Runner image. ubuntu-latest is Ubuntu 26.04 now, where Playwright 1.56 can't install Chromium. The update workflow now runs on ubuntu-24.04, like playwright.yml.

Commits:

• f71ee7c: the audit-override fix in scripts/pnpm-helpers.sh
• 3d4b28f: the runner pin in .github/workflows/update-nutrient-sdk.yml
• a0201e5: the bump itself, made by the update workflow running from this branch. Every example's @nutrient-sdk/viewer and CDN references move from 1.24.0 to 1.25.0, plus the audit fixes.

The update workflow ran from this branch for 1.25.0 and passed, e2e smoke tests included: https://github.com/PSPDFKit/nutrient-web-examples/actions/runs/41471879240. Its log shows the fix at work: "No published deepmerge matches ^4.3.2; dropping the audit override for deepmerge@>=4.2.0 <=4.3.1." The workflow opened this PR, so the Biome and Playwright workflows didn't run on it. The run covers both.

Please check before merging

svelte-kit and vue-composition-api aren't in the e2e suite, and both picked up new audit overrides:

• svelte-kit now gets @sveltejs/kit 3. Two low-severity SvelteKit advisories are fixed only in 3.0.0. The example still uses @sveltejs/adapter-auto 7, which declares @sveltejs/kit ^2, and TypeScript 5.9, while kit 3 expects TypeScript 6. Please run the example. If it breaks, either move it to adapter-auto 8 and TypeScript 6, or drop that override.
• Both move minimatch from 10.2.5 to 11.0.4. The only consumer is glob@7.2.3, which main already forces onto minimatch 10, so this is a smaller step.

Type

• New framework example
• Update existing example
• SDK version bump
• Bug fix
• Repo infrastructure (CI, scripts, docs)

Checklist

• pnpm run format passes (Biome), in the workflow run above
• Example has start and start:e2e scripts in package.json (no new example)
• Playwright smoke tests pass, in the workflow run above (svelte-kit and vue-composition-api are excluded from that suite)
• README.md included with prerequisites, setup, and usage (no new example)
• Uses current pinned @nutrient-sdk/viewer version