fix(deps): bump js-yaml and brace-expansion out of their advisories

Both are dev-only transitive dependencies and neither can reach anyone who
installs this package — "files" ships dist/, README and LICENSE, so no lockfile
and no dev tree goes with it. The exposure is the local and CI toolchain only.

  js-yaml         4.3.0  -> 4.3.1   quadratic CPU on !!omap (CVE-2026-59870),
                                    via @eslint/eslintrc
  brace-expansion 1.1.17 -> 1.1.18  DoS via unbounded intermediate arrays
                                    (GHSA-rgw5-rvv9-x895), via minimatch

The 5.x copy of brace-expansion under @typescript-eslint/typescript-estree was
already carried to 5.0.9 by the typescript-eslint 8.66.0 bump in #26.

Lockfile only: both existing ranges already admitted the fixed versions, so
package.json is untouched and no direct dependency changes. Verified with a clean
`npm ci` — lint, format, both tsconfigs and the full suite pass, and `npm audit`
reports zero.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking