Fix scheduled security dependency findings

[jremick]

Summary

• update all vulnerable brace-expansion lockfile entries to patched releases
• update runtime fast-uri to 3.1.4
• update direct and overridden js-yaml to 4.3.0
• override shell-quote to 1.9.0 because concurrently 10.0.3 still pins the vulnerable 1.8.4 release

This addresses the five high-severity npm findings and three actionable runtime-image findings reported by the July 22 scheduled security run.

Verification

• npm audit --audit-level=high
• npm audit --omit=dev --audit-level=high
• npm run verify:docs
• npm run verify:release from a clean source snapshot: 47 test files and 690 tests passed; build, release-readiness evaluation, packaging, and container smoke passed
• Trivy 0.70.0 runtime scan with the repository VEX policy: zero fixable high or critical findings

The unrelated local release-evidence directory and untracked PNG were not included.