fix(deps): bump js-yaml and brace-expansion out of their advisories

Both are dev-only transitive dependencies and neither can reach anyone who
installs this package — "files" ships dist/, README and LICENSE, so no lockfile
and no dev tree goes with it. The exposure is the local and CI toolchain only.

  js-yaml         4.3.0 -> 4.3.1   quadratic CPU on !!omap (CVE-2026-59870),
                                   via @eslint/eslintrc
  brace-expansion 1.1.17 -> 1.1.18 DoS via unbounded intermediate arrays
                  5.0.8  -> 5.0.9  (GHSA-rgw5-rvv9-x895), via minimatch and
                                   @typescript-eslint/typescript-estree

Lockfile only: both existing ranges already admitted the fixed versions, so
package.json is untouched and no direct dependency changes. Verified with a clean
`npm ci` — lint, format, both tsconfigs and the full suite pass, and `npm audit`
reports zero.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking