fix(deps): bump nanoid and js-yaml to patched versions (alerts #262, #264)

Resolves two open high-severity Dependabot alerts. Both packages are
transitive-only -- neither is declared as a direct dependency in any
workspace -- so both are pinned through scoped root resolutions.

- nanoid 3.3.16 -> 3.3.18 (alert #264, GHSA-2v37-7h3g-55p8,
  CVE-2026-67213): custom generators can loop indefinitely when size is
  zero. Reaches the tree via postcss@8.5.23. Fixed with a
  descriptor-scoped resolution "nanoid@npm:^3.3.16" so the patch stays
  on the 3.x line instead of forcing the breaking 5.x/6.x major, and so
  any other nanoid major would remain untouched.

- js-yaml 4.3.0 -> 4.3.1 (alert #262, GHSA-5p4m-2wfm-xmqj): quadratic
  CPU consumption in !!omap resolution. The existing root resolution
  already collapses every js-yaml descriptor onto the 4.x line, so this
  is a patch-level bump of that entry (^4.3.0 -> ^4.3.1). Deliberately
  not re-scoped per descriptor: doing so would un-collapse the 3.x
  requesters and reintroduce a js-yaml 3.14.x entry, which is itself
  vulnerable under the same advisory.

Lockfile regenerated with `corepack yarn install`, never hand-edited.
The resolved-entry count in yarn.lock is unchanged at 2144 with exactly
two removals and two additions, so there is no unrelated churn.

Author: soberm

package.json

@@ -106,9 +106,10 @@
     "webpack-dev-server": "^5.2.6",
     "brace-expansion": "^5.0.9",
     "@opentelemetry/core": "^2.8.0",
-    "js-yaml": "^4.3.0",
+    "js-yaml": "^4.3.1",
     "http-proxy-middleware": "^2.0.10",
     "next/sharp": "^0.35.0",
-    "next/postcss": "^8.5.12"
+    "next/postcss": "^8.5.12",
+    "nanoid@npm:^3.3.16": "^3.3.18"
   }
 }

yarn.lock

@@ -18309,14 +18309,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-yaml@npm:^4.3.0":
-  version: 4.3.0
-  resolution: "js-yaml@npm:4.3.0"
+"js-yaml@npm:^4.3.1":
+  version: 4.3.1
+  resolution: "js-yaml@npm:4.3.1"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.js
-  checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff
+  checksum: 10c0/13c500ca322e0c3f8c81686e6ecda96d2ea37b45247a420c17c7db36932d6965cc27391abc2d1a104501600e7f0d947a5f8b7be6db619c4fefa87901b3512807
   languageName: node
   linkType: hard
 
@@ -19581,12 +19581,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nanoid@npm:^3.3.16":
-  version: 3.3.16
-  resolution: "nanoid@npm:3.3.16"
+"nanoid@npm:^3.3.18":
+  version: 3.3.18
+  resolution: "nanoid@npm:3.3.18"
   bin:
     nanoid: bin/nanoid.cjs
-  checksum: 10c0/bbf2dcffe22d2b62d16de2711752070b539c0f644c7916f823ad6521986b2078cbe524f2d6240f58c46e9141ea0c7b87a029e100c0f7f175228cacaf30e41bba
+  checksum: 10c0/b994b4e396730f8be2520923284e2040d61eaee55cc6d4935ef6d38d34bafdc46133eda4d3faea5073bda545aa6079d82b886caeac5c731cf9ac18bcc1301425
   languageName: node
   linkType: hard