build(deps): upgrade mermaid-cli 10.9.1 -> 11.16.0 to clear the stuck CVEs

Dependabot's own update job failed on every run with tar-fs
"fix_available: false ... the available update path still resolves it to
2.1.1" — there is no fix path while pinned to mermaid-cli 10.x, so the 6
alerts (4x tar-fs, 2x ws) could never self-heal and would accumulate.

Upgrading resolves all six: tar-fs leaves the dependency tree entirely and
ws goes 8.13.0 -> 8.21.1 (advisories require >= 2.1.4 and >= 8.21.0).

v11 is a major bump, so rendering was verified rather than assumed — every
diagram in this book was rendered locally with 11.16.0 against system
Chrome before this commit.

Author: yeasy

tests/test_workflows.py

@@ -188,8 +188,8 @@ def test_downloads_mermaid_and_artifacts_have_integrity_gates(self):
             self.assertNotIn("continue-on-error", text, name)
         package = json.loads((ROOT / "tools/mermaid/package.json").read_text(encoding="utf-8"))
         lock = json.loads((ROOT / "tools/mermaid/package-lock.json").read_text(encoding="utf-8"))
-        self.assertEqual(package["dependencies"]["@mermaid-js/mermaid-cli"], "10.9.1")
-        self.assertEqual(lock["packages"][""]["dependencies"]["@mermaid-js/mermaid-cli"], "10.9.1")
+        self.assertEqual(package["dependencies"]["@mermaid-js/mermaid-cli"], "11.16.0")
+        self.assertEqual(lock["packages"][""]["dependencies"]["@mermaid-js/mermaid-cli"], "11.16.0")
 
     def test_pandoc_is_installed_and_verified_before_publication_source_checks(self):
         for name in ("ci.yaml", "auto-release.yml", "preview-pdf.yml"):