Drop js-yaml/picomatch/ws overrides — they broke real consumers

Codex flagged js-yaml, and the same reasoning applies to picomatch/ws:
each global override forced a consumer past its declared major.

- js-yaml@4.3.0 broke gray-matter@4.0.3 (declares js-yaml ^3.13.1, calls
  the safeLoad/safeDump APIs removed in v4). gray-matter drives markdown
  frontmatter parsing in core config/skill loading, so it threw at
  runtime (invisible to typecheck). Verified fixed: a clean install links
  gray-matter -> js-yaml@3.15.0 and matter(...) parses again.
- picomatch@4.0.5 forced onto micromatch@4.0.8 (^2.3.1; even latest
  micromatch pins picomatch 2).
- ws@8.21.0 forced onto @slack/socket-mode@1.3.6 (^7). ws@7.5.11 is
  already patched for CVE-2024-37890; getting ws 8 there needs
  @slack/bolt 3 -> 4 (a Slack-bot API migration).

Each override only ever targeted a consumer that requires the old major,
so removing them just restores natural, working resolution. The remaining
sub-floor transitives (js-yaml 3 / picomatch 2 / ws 7 / esbuild 0.19) are
documented as follow-ups needing parent bumps or replacements.

Full bun turbo typecheck passes (25/25).

Author: sauravpanda