Fix dev-dependency Dependabot advisories via npm audit fix (#135)

Resolves the nine open Dependabot alerts, all development-scope
transitive deps in package-lock.json:

- js-yaml 4.1.1 -> 4.3.1, 3.14.2 -> 3.15.1 (via nyc/@istanbuljs)
- brace-expansion 1.1.14 -> 1.1.18, 5.0.5 -> 5.0.9 (via eslint, mocha, glob)
- @babel/core 7.28.5 -> 7.29.7

Lockfile-only; every update satisfies the existing package.json ranges.
npm audit reports 0 vulnerabilities. Tests (56 passing) and lint pass.


Claude-Session: https://claude.ai/code/session_01FAATgceWwet75x4EebX97d

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: theRealPadster