fix(deps): override js-yaml to 4.3.1 to patch merge-key DoS

Transitive dep pulled in at 4.2.0 via rc-config-loader/textlint's
secretlint chain (GHSA-52cp-r559-cp3m, CVE-2026-59869). Neither
dependent's package.json is in this workspace, so a pnpm override
is the only way to reach it.

Closes Dependabot alert #19.

Author: jasonworden

pnpm-lock.yaml

@@ -9,6 +9,11 @@ catalog:
   vite: ^6.4.3
   typescript: 6.0.3
   '@types/node': ^22.0.0
+overrides:
+  # GHSA-52cp-r559-cp3m / CVE-2026-59869: js-yaml merge-key quadratic CPU DoS,
+  # fixed in 4.3.0. Transitive-only (via rc-config-loader/textlint's secretlint
+  # chain), so a catalog entry can't reach it — force the patched version here.
+  js-yaml@^4.1.1: ^4.3.0
 allowBuilds:
   '@biomejs/biome': true
   esbuild: true