fix(deps): update fast-uri audit fix

[fullofcaffeine]

Why

The release dependency audit now rejects fast-uri 3.1.5. New security advisories cover that version, so every current CI run stops before secret scanning.

This failure also blocks unrelated compiler pull requests. The repository requires a green compiler backend before downstream application work continues.

What changed

The lockfile now selects fast-uri 3.1.6 through the existing Ajv dependency. No compiler source, runtime source, or public package surface changed.

Verification

• npm ci --ignore-scripts --no-audit --no-fund
• node scripts/ci/npm-audit-policy.js
• npm run test:npm-audit-policy
• npm ls fast-uri --all reports only fast-uri@3.1.6
• git diff --check

Limits

The audit policy still lists approved advisories for unused release plugins. This pull request removes only the new unapproved fast-uri findings.

Agent provenance

Prepared by the repository-maintenance agent after PR #18 exposed a new default-branch dependency-audit failure. The agent owns review fixes and rebasing for this branch.

Final approval and merge remain maintainer-only. Other agents must not modify this branch without a recorded handoff.

[fullofcaffeine]

Hosted follow-up: both snapshot jobs on this exact dependency head advanced through late curated Clippy cases and were cancelled at the workflow limit, exactly 60 minutes after job start. The dependency and RustSec audits themselves passed.\n\nA focused stacked repair is now under review in PR #20 at 72ab847. Its review diff changes only the snapshot timeout and the focused timeout contract from 60 to 90 minutes.\n\nIntended integration order:\n1. A maintainer reviews and merges PR #20 into this branch.\n2. This PR reruns at the new exact head; all required hosted checks must pass.\n3. A maintainer merges this PR into main.\n4. PR #18 rebases onto that repaired main and proves its own exact head.\n\nThe repository-maintenance agent owns review fixes and rebasing for both repair branches. Final approval and merge remain maintainer-only.