Clear yaml and esbuild development-tool advisories

[leehack]

Problem

A live npm audit against main at 0142374ecd0a1a4e01524e09ed3142bf4e0b6974 reports two direct development dependency advisories:

• yaml@2.8.1: moderate, GHSA-48c2-rrv3-qjmp, fixed in >=2.8.3. The repository uses it to parse checked-in workflow files in the input-transport contract, not untrusted production input.
• esbuild@0.27.7: low, GHSA-g7r4-m6w7-qqqr, fixed in >=0.28.1. The vulnerable Windows development-server path is not invoked by this repository, which uses the build API.

GitHub Dependabot alerts are currently disabled for this repository, so the live API does not provide an alert/remediation surface for either finding. No open issue or PR mentioning either package/advisory was found before filing.

These findings do not affect the published JS/WASM runtime artifacts on the exercised paths, but they should be cleared or explicitly dispositioned before applying the zero-known-regression release policy.

Acceptance criteria

• Update yaml to a non-vulnerable release and regenerate package-lock.json.
• Update esbuild to a non-vulnerable release, verifying generated JS remains byte/behavior compatible or documenting intended output changes.
• Run npm audit, npm run check:js, python3 scripts/verify_ci_reliability.py, and exact-head CI.
• Maintainer decision, separately from code changes: enable Dependabot alerts/updates or document the replacement advisory-monitoring mechanism.