chore: js-yaml 3.15.2 (GHSA-2883-xcg3-v3hh)

Lockfile-only: gray-matter's ^3.13.1 range already allows the patched
3.15.2, and nothing else in the tree pulls js-yaml. The advisory went
public today and turned CI's production audit red on the 1.1.17 merge,
whose commits only moved the pin; this clears the shell's own audit.
The upstream checkout at the pin carries the same js-yaml advisory plus
two svgo ones, so the second audit in that CI step stays red until the
upstream lockfile moves and the pin follows.

Author: adibhanna