fix(deps): bump cssnano to 8.0.10 and refresh CSS baseline

[abbybowman]

What this PR does

Supersedes Dependabot #207 (close unmerged once this lands). Bumps cssnano (8.0.5 to 8.0.10) and postcss-discard-comments (8.0.3 to 8.0.4), both output-affecting build dependencies, and refreshes the compiled-CSS baseline hash they move. Dependabot's own PR can't self-update the baseline, so it fails check:css-hash by design; this branch does the bump plus the baseline refresh together.

Type of change

• Tooling or CI (no effect on published CSS)

How to review

The cssnano 8.0.6-8.0.10 releases are all minifier correctness fixes -- postcss-merge-rules, postcss-merge-longhand, postcss-discard-empty cascade-layer optimization, and spec-algorithm gradient minification. These change the bytes of the minified CSS (hence the new baseline) without changing how anything renders.

1. package.json / package-lock.json: cssnano ^8.0.2 to ^8.0.10, postcss-discard-comments 8.0.3 to ^8.0.4 (carets for consistency with other dev deps; check:css-hash is the regression guard).
2. scripts/css-output-hash.txt: baseline refreshed from 9df0f27 to 580cbae. Verified reproducible via clean npm ci build (the old baseline was confirmed to rebuild exactly before refreshing, so the new hash is a real cssnano-output change, not environment drift).

Before requesting review

• npm run lint, npm run format, and npm test pass locally (242 tests)

If your change affects how anything renders (styles, tokens, story markup, icons, or fonts):

• Chromatic visual regression: zero changes across all snapshots -- confirms the minifier output changes are visually identical
• HDS version-stamp comment verified present in all three min.css bundles after the postcss-discard-comments bump

If your change ships in the package (styles, tokens, or src/assets/**):

• No changeset needed -- dev-only build-tool bump, no change to published CSS or the public API surface

Notes for reviewers

The HDS stamp survives minification after the postcss-discard-comments bump (important-comment /*! syntax still respected) -- checked in all three bundles.