feat: adds nest example - #188

Six open Dependabot alerts, all reachable because the overrides written to
close earlier ones had gone stale in two distinct ways.

OVERTAKEN SELECTORS go quiet. `postcss@<8.5.10` stopped matching once the
tree resolved 8.5.14, so the entry sat here looking like a fix while a
vulnerable version installed underneath it (#167 GHSA-r28c-9q8g-f849 HIGH,
path traversal reading arbitrary .map files via attacker-controlled
sourceMappingURL; #176 its incomplete-fix follow-up). `js-yaml@<3.15.0` was
overtaken by its own fix — the tree resolved exactly 3.15.0, so nothing
matched and nothing lifted it to 3.15.1 (#189).

EXACT PINS INSIDE A STILL-MATCHING RANGE are worse: they cannot self-heal
and Dependabot cannot fix them. `js-yaml@>=4.0.0 <5` kept matching, so a
pin written to FIX an advisory was holding the tree at 4.2.0 and blocking
4.3.1 (#155, #188 — quadratic-CPU DoS via merge-key chains, then `!!omap`
duplicate-key detection). `fast-uri@<3.1.3` did the same at 3.1.3 while
#158 needs 3.1.4 and #175 needs 3.1.5.

Both shapes are now written into the comments, because the lesson is
reusable: keep the ceiling AHEAD of the patched floor rather than at it.

THE js-yaml CAUTION IS DISCHARGED, checked rather than assumed. The
comment warned that a past bump broke changesets. @changesets/[email protected]
declares `js-yaml: ^4.1.1`, which 4.3.1 satisfies; 4.2.0 and 4.3.1 have
identical `dependencies` and `exports`, no `engines`, no `main`; 4.3.0 and
4.3.1 are security backports only, with no API removal on the 4.x line —
the breaking churn (grouped constant exports, MERGE_KEY removal, mandatory
identify) is all on 5.x, which the `<5` ceiling already excludes. Verified
by resolving js-yaml from @changesets/parse's own path (4.3.1, not a nested
copy) and running `changeset status`, which parsed all 14 changesets and
produced the correct per-package bumps.

No cooldown bypass was needed: every target is 13-19 days old against the
7-day minimumReleaseAge. The comment claiming "4.3.0 is still inside the
cooldown" was 54 days stale.

None of the four is a runtime dependency of any published package, so
nothing ships them and this needs no changeset.

Also corrects dependabot.yml's "the only Rust in the repo" — there are two
cargo entries, and the /packages/eql one landed with the subtree.