npm audit: 18 high advisories (js-yaml runtime, electron-builder tree)

[rebaserHEAD]

npm audit reports 18 high-severity advisories, pre-existing and unchanged through PR #83. Two distinct buckets:

• js-yaml — the only RUNTIME dependency in the list; everything else is build tooling. Worth resolving first and on its own.
• electron-builder tree + postcss — dev/build-time only; lower blast radius, likely resolved by routine major bumps.

Dependabot is live as of PR #83 (weekly, grouped dev/runtime), so some of this will arrive as PRs on its own. What is left to do by hand:

• Triage which advisories actually apply to how we use the packages (a yaml bomb in js-yaml matters; an advisory in an electron-builder subdep that only runs on release CI matters less).
• npm audit fix for the free wins; evaluate the breaking-change ones case by case.
• Whatever remains unfixable upstream gets documented here as accepted, with the reason.