chore(deps): patch-duty — brace-expansion 1.1.21 / 2.1.7, js-yaml 3.15.2 (js-sdk)

[nicolasiscoding]

Weekly dependency security maintenance for the JavaScript package and the repo root. Overrides and lockfiles only; no source changes.

Package	Change	Where	Kind
brace-expansion (1.x)	→ 1.1.21	root + packages/js-sdk	override, dev tooling
brace-expansion (2.x)	→ 2.1.7	root + packages/js-sdk	override, dev tooling
js-yaml	3.15.1 → 3.15.2	packages/js-sdk lockfile	dev tooling

npm audit: root 1 high → 0, packages/js-sdk 2 high → 0. The js-yaml override already asked for ^3.15.2, but the js-sdk lockfile was still resolved to 3.15.1.

All three are development-only (test and lint tooling) and are not dependencies of the published package, so there is nothing to release. Supersedes #75.

🤖 Generated with Claude Code

[nicolasiscoding]

CI/CD green, Claude reviewed. All 11 checks passed (six language test suites plus CodeQL). Reviewed both lockfiles package by package: 5 entries changed, all development-only patch bumps (brace-expansion 1.1.18 → 1.1.21 and 2.1.4 → 2.1.7, js-yaml 3.15.1 → 3.15.2), no packages added or removed, no dependency-range or engine changes, registry sources with integrity hashes. None of them is a dependency of the published package. Branch is up to date with main.