fix(deps): pin js-yaml to >=4.2.1 via npm overrides

[birme]

Summary

• npm ls js-yaml showed js-yaml@3.15.2 pulled in transitively via ts-jest → @jest/transform → babel-plugin-istanbul → @istanbuljs/load-nyc-config
• npm audit fix did not address this (npm audit does not flag it as a CVE in the current advisory database, but the version is below the required >=4.2.1 threshold)
• Added "overrides": { "js-yaml": ">=4.2.1" } to package.json and ran npm install to regenerate the lockfile
• All resolved versions of js-yaml are now 5.4.2 (satisfies >=4.2.1)

Test plan

• Run npm ls js-yaml and confirm no version <4.2.1 appears
• Run npm test — 243 tests pass
• Run npm run typecheck — no errors

Closes #279