fix(deps): bump js-yaml overrides to patched 3.15.1 / 4.3.1 (#2073)

The root `overrides` block pinned js-yaml to versions inside the
advisory range (3.15.0 and 4.2.0), so `npm audit fix` reported a fix
as available and then changed nothing — overrides take precedence.

Bumps both pins to the patched `v3-legacy` / `v4-legacy` releases,
addressing GHSA-52cp-r559-cp3m and GHSA-5p4m-2wfm-xmqj.

Exposure is development-only: `npm ls js-yaml --omit=dev` is empty and
both copies are reachable only via eslint and ts-jest/istanbul, neither
of which ships in the published package.

Both patched versions have an identical dependency and bin shape, so
the lock entries were patched in place — 6 lines, no transitive churn.

Fixes #2072


Claude-Session: https://claude.ai/code/session_01Gq5jMmxRUphrVbfNbYVmQH

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

package.json

@@ -86,8 +86,8 @@
     "@babel/core@<=7.29.0": "^7.29.6",
     "esbuild@<0.28.1": "^0.28.1",
     "minimatch@<3.1.4": "3.1.5",
-    "js-yaml@<4": "3.15.0",
-    "js-yaml@>=4": "4.2.0"
+    "js-yaml@<4": "3.15.1",
+    "js-yaml@>=4": "4.3.1"
   },
   "engines": {
     "node": ">=22.7.5"