fix(deps): update js-yaml to 4.3.1

[rogerchappel]

Summary

• refresh the lockfile from js-yaml 4.3.0 to 4.3.1
• resolve GHSA-5p4m-2wfm-xmqj without unrelated dependency churn
• document the dependency maintenance in the Unreleased changelog

Commits

• 0aecfd1 fix(deps): update js-yaml to 4.3.1
• b5af1c8 docs(changelog): note js-yaml security refresh

Verification

• npm ci
• npm explain js-yaml (resolves 4.3.1 through @eslint/eslintrc)
• npm audit (0 vulnerabilities)
• npm audit --omit=dev (0 vulnerabilities)
• npm run release:check (72 tests, typecheck, lint, coverage, CLI smoke, package smoke)
• git diff --check

CI runs the same clean install and release gate on the declared Node 20.19.0, 22, and 24 matrix.