chore: refresh security and runtime dependencies

[corwinm]

Summary

• refresh read-yaml-file's transitive js-yaml from 3.14.2 to patched 3.15.0 for GHSA-h67p-54hq-rp68
• update the requested patch/minor tooling dependencies: @changesets/cli 2.31.1, @sinclair/typebox 0.34.52, @types/node 24.13.3, and Vitest 4.1.10
• update the aligned @earendil-works/pi-ai, pi-coding-agent, and pi-tui family from 0.79.8 to 0.80.10 (including transitive pi-agent-core 0.80.10)

Pi 0.80 compatibility review

• Node requirement remains >=22.19.0
• the repo's imported Pi extension/TUI symbols and AssistantMessage type remain available; TypeScript compilation succeeds without source changes
• Pi 0.80 includes breaking changes to low-level/global pi-ai APIs, but this repo does not consume the affected stream/provider/auth APIs
• all extension tests, builds, and dry-run package builds pass against 0.80.10

Lockfile review

• direct manifest changes are limited to the seven requested dependency entries
• the audit-only change is scoped to read-yaml-file > js-yaml 3.14.2 → 3.15.0
• the larger transitive refresh is attributable to Vitest 4.1.10 updating its aligned Vitest/Vite/Rolldown dependency family and platform bindings

Verification

• npm ci
• npm run ci (typecheck, 58 tests, build, and all workspace dry-run packs)
• npm audit --audit-level=moderate (0 vulnerabilities)
• git diff --check
• GitHub Actions CI: passed on Node 22 and Node 24