fix/next-pin-cve-acceptance
main
@payloadcms/next@3.90.2 peer-requires next <15.5.0; 15.5.27 was an unsupported combo. Owner chose the pin + documented risk (SECURITY.md §8). Transitive overrides (undici/sharp/postcss/sass) stay. Gate skipped: parallel session WIP still in tree.