chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Replaced the abandoned ajv-cli@5.0.0 with @jirutka/ajv-cli@^6.0.0, a maintained fork that declares fast-json-patch: ^3.1.1 natively. This resolves the prototype pollution vulnerability (alert Add flag definition #1, high severity) without any overrides entry.
• Regenerated package-lock.json; npm audit reports zero vulnerabilities.
• Added -o /dev/null to the ajv compile invocations in the Makefile. In @jirutka/ajv-cli@6, running ajv compile without -o dumps the full compiled JS validator module to stdout (an intentional breaking change from v5, where that output was silently discarded). Since this target only validates schemas and never captures compiled output, -o /dev/null restores the original behavior: just the schema X is valid status lines.

Notes

ajv-cli has had no release since v5.0.0 in March 2021. The upstream fix PR (ajv-validator/ajv-cli#227) has been open for 3+ years with no maintainer response. @jirutka/ajv-cli is a maintained fork published on npm under the same ajv binary name; the compile -s/-r interface used in this repo is unchanged.

[gemini-code-assist]

Code Review

This pull request adds an override in package.json to force ajv-cli to use fast-json-patch version ^3.1.1, with corresponding updates in package-lock.json. Feedback was provided to run npm install to ensure the overrides metadata is correctly mirrored in the root of package-lock.json to prevent the lockfile from being out of sync.