Apply non-breaking npm audit fix lockfile updates

[Copilot]

Ran npm audit fix without force/overrides to apply only automatically resolvable dependency security updates. This PR updates the lockfile while preserving current dependency constraints and avoiding breaking-version remediation paths.

• Scope

  • Updated package-lock.json only.
  • No source code, tests, scripts, or package manifest changes.

• Resolved via lockfile refresh

  • Bumped transitive/dev-resolved versions where safe, including:
    • brace-expansion 2.0.2 → 2.1.1
    • js-yaml 4.1.1 → 4.2.0
    • mocha lockfile resolution 11.7.5 → 11.7.6

• Explicitly out of scope

  • Advisories requiring npm audit fix --force (not permitted by this task) remain unchanged.

- "node_modules/js-yaml": { "version": "4.1.1", ... }
+ "node_modules/js-yaml": { "version": "4.2.0", ... }

Original prompt

Run npm audit fix. Create a PR. No force flags or overrides.

Created from VS Code.