deps: floor js-yaml (npm)

[jason-anthropic]

Floor js-yaml to 4.3.1 via a root overrides entry in package.json (fixes CVE-2026-53550, CVE-2026-59869 / GHSA-5p4m-2wfm-xmqj).

Registry provenance: this repository's lockfile is public-registry-routed by convention (its own installs fetch from public npm), so the 1 new/changed tarball URL(s) in this PR are spelled on that same public host like the rest of the file. They were resolved through Anthropic's Dependant-gated Artifactory proxy at regeneration time (the environment that regenerated the lock can only resolve through that proxy), and every genuinely new (package, version) was re-verified as servable from the gated route with matching integrity — the public URLs point at byte-identical tarballs. No Artifactory hostname is introduced into this public-convention lock.

Breakage risk: low — js-yaml is a dev-only transitive pulled in solely by eslint (@eslint/eslintrc, declared range ^4.1.0), not a runtime dependency; this is a minor move within major 4 (4.1.1 → 4.3.1) with no first-party call sites, so nothing in the shipped package is affected.

package	floor	manifest
js-yaml	4.3.1	package.json (overrides)

The only consumer's range (^4.1.0) already admits the floor, so the override is for durability — it prevents a future unrelated lock regen from floating the dev transitive back down below the fix. npm ls confirms js-yaml@4.3.1 overridden. The regenerated lock moves only the js-yaml stanza (argparse and all other packages unchanged); the new tarball URL is spelled on registry.npmjs.org to match this lock's convention, and integrity pins the exact bytes.

Verification:

• lockfile_regen — npm install --package-lock-only --ignore-scripts — exit 0 (only js-yaml stanza changed).
• checker — npm ls js-yaml --package-lock-only --all — exit 0 (js-yaml@4.3.1 overridden, no invalid entries).
• no_public_registry — diff grep for registry/script/patch additions — exit 0, none.
• fod_hash_sweep — no Nix/FOD hash consumers reference the touched files.
• frozen_install — npm ci — exit 1, blocked by a pre-existing mirror gap: the internal registry returns 404 for eslint-config-prettier@8.10.2, a version already pinned by the base lock and unrelated to js-yaml. build/typecheck/runtime_probe could not run for the same reason (no node_modules); the js-yaml@4.3.1 tarball itself fetches 200.

Residuals (pre-existing, not changed by this PR):

• npm_ci cannot complete on the BASE tree either (npm error 404 Not Found - GET https://artifactory.infra.ant.dev/artifactory/api/npm/npm-all/eslint-config-prettier/-/eslint-config-prettier-) — pre-existing and unrelated to this change; install proof is inconclusive

_{Automated dependency-vulnerability floor (Versant); every verification step above was executed, not inferred.}