map: MapStage on maplibre-gl 6 (critical XSS GHSA-jrc7-96c5-q579): use deck.gl MapLibreOverlay #601

Dependabot alerts #2 (packages/ui, dev) and #3 (site, runtime): critical, GHSA-jrc7-96c5-q579 / CVE-2026-85061, maplibre-gl <= 6.4.0, patched in 6.4.1. DOM.sanitize() iterates the live elem.attributes while removing attributes, so it skips the attribute next to a removed one (<details open onload="1" ontoggle="...">): zero-click XSS through the attribution control for untrusted or third-party attribution strings.

Our exposure: the lib never renders attribution strings of its own and ships no map data; the site demo uses an inline offline style. A consumer whose style carries untrusted attribution is exposed, and a 5.x peer range cannot take the patch (fixed only in >= 6.4.1).

#488 (bump to 6.4.1) was closed and the peer pinned to ^5 (#470/#479) because @deck.gl/mapbox 9.4 MapboxOverlay throws Cannot read properties of undefined (reading 'height') on maplibre 6. deck.gl 9.4.0 now ships @deck.gl/maplibre (MapLibreOverlay, peer maplibre-gl ^4.5.1 || ^5 || ^6), the supported way to drive maplibre.

Plan (test first):

• MapStage uses MapLibreOverlay from @deck.gl/maplibre for engine="maplibre" (interleaved), keeps MapboxOverlay for engine="mapbox".
• Peers: maplibre-gl ^5.0.0 || ^6.0.0, new optional peer @deck.gl/maplibre ~9.4.0.
• Repo and site bump to maplibre-gl >= 6.4.1 (closes the alerts), @deck.gl/maplibre 9.4.0.
• Docs and changeset.