Fix dependency-audit: bump fast-uri override to clear HIGH advisories

[grimicorn-agent]

What changed

Bumps the existing overrides.fast-uri pin in package.json from ^3.1.5 to ^3.1.7, resolving fast-uri to 3.1.7 in package-lock.json.

Why

Four new HIGH-severity advisories were published against fast-uri versions <3.1.6:

• GHSA-5jgf-p345-68v8 (host confusion via skipped IDN canonicalization)
• GHSA-f65p-4m7j-42xc (SSRF via malformed IPv6 normalization)
• GHSA-fph4-wmhf-6fwf (SSRF via repeated hostname percent-decoding)
• GHSA-jqff-g426-hqxp (host confusion via percent-encoded scheme normalization)

The repo already carries a fast-uri override (from #61, for a prior advisory round), pinned to ^3.1.5 — which is itself in the newly-vulnerable range. This was failing npm audit --audit-level=high on every open PR (main would fail too if re-audited, since npm audit queries the live advisory DB rather than a snapshot).

fast-uri is transitive: conf@15.1.0 → ajv@8.18.0 → fast-uri. ajv@8.18.0 declares fast-uri: ^3.0.1, so the fix stays within the 3.x major rather than jumping to fast-uri@4.x (which would fall outside ajv's declared range).

The override floor is set to ^3.1.7 — the exact version verified locally and recorded in the lockfile — rather than ^3.1.6 (the first version outside all four advisory ranges), so the pin can't silently resolve to an untested patch version.

Verification

• npm ci (mirrors the dependency-audit CI job) → npm audit --audit-level=high exits 0, only the 2 pre-existing moderate advisories (@humanfs/node, fflate) remain, both below the high gate and out of scope for this PR.
• npm run lint — clean.
• npm run test:ci — 837 tests passing across 28 files.
• Independent Agent Code Review loop run (2 rounds); trail posted as a PR comment.

No issue to close — this is CI maintenance triggered by newly-published advisories, not a tracked issue.

[grimicorn-agent]

Independent Agent Code Review trail

Round 1 — flagged: the override floor was set to ^3.1.6, but the version actually installed and audited was 3.1.7. A fresh install landing exactly on 3.1.6 would never have been verified against the advisories, so the floor should track the tested version.
→ Fixed: bumped the floor to ^3.1.7 (matches the lockfile), re-ran npm install, confirmed it still resolves to 3.1.7 and npm audit --audit-level=high still exits 0.

Also noted (informational, not actioned): overrides is a local-install mechanism — if this package were consumed as a dependency by another project, npm wouldn't honor overrides declared here, so the advisory would stay open downstream. This is a pre-existing limitation of the pattern already used for brace-expansion and nanoid in this file (from earlier PRs #61 and #73), not something introduced by this change, and fast-uri here is a build/CLI-tooling transitive (via conf → ajv), not a runtime dependency exposed to consumers of the published CLI. Left as-is, consistent with existing convention.

Round 2 — No issues found.

Unresolved after review: none.