fix(deps): update hono and js-yaml overrides

[nishuzumi]

What

Follow-up to #191 (and #125) for the advisories published on 2026-09-08, which post-date that PR and its review.

Workspace overrides:

• hono 4.12.34 -> 4.13.7 — GHSA-crvj-82cr-hjcx, GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv (moderate, first patched in 4.13.5), plus the hono/jsx XSS GHSA-hxh3-vqpv-xpqv fixed in 4.13.7. Production path: @themoss/mcp-server > @modelcontextprotocol/sdk > @hono/node-server@2.0.12 (peer hono: ^4).
• js-yaml@^3.0.0 3.15.1 -> 3.15.2 and js-yaml@^4.0.0 4.3.1 -> 4.3.2 — GHSA-2883-xcg3-v3hh (high; dev-only via @changesets/cli).

The lockfile contains only the matching resolution changes (overrides block, three package entries, and the @hono/node-server(hono@…) / @changesets edges). No source, API, Protocol, or documentation change; changeset N/A per the #188/#191 precedent.

Verification

• pnpm install --frozen-lockfile, pnpm lint, pnpm build, pnpm typecheck, pnpm test:offline: pass (MCP 22/22).
• pnpm audit --prod: 0 advisories.
• Full audit: only vitest/@vitest/mocker@3.2.6 moderate GHSA-82fw-gwwq-j7x9 (patched in vitest ≥4.1.11 — a major bump that ADR 0001 pins away from; separate decision) and the pre-existing dev-only esbuild@0.27.7 low.
• Integrity of hono@4.13.7, js-yaml@3.15.2, js-yaml@4.3.2 matches the npm registry; all three were published 2026-08-26/2026-09-04, well past minimumReleaseAge: 1440.
• pnpm install --lockfile-only is a no-op on the regenerated lockfile; git diff --check clean.

The hosted ci job will stay red on the Aave wall-clock quarantine (#185, #195) exactly as on main; that failure is unrelated to this change.

[pillowtalk-Qy]

Thanks Box. I independently reviewed the exact head a578961 against the current mainline.

No blocking issue found in this focused dependency update:

• the diff is limited to pnpm-workspace.yaml and the corresponding lockfile resolutions;
• frozen install and peer checks pass;
• lint, build, serial typecheck, and the full offline suite pass;
• pnpm audit --prod reports 0 advisories;
• the lockfile integrities match the npm registry, and the updated releases satisfy the repository release-age guard.

The remaining full-audit findings are the previously documented dev-only Vitest moderate advisory and esbuild low advisory, outside this PR's stated scope. The hosted CI failure is the existing Aave baseline/quarantine failure and is unrelated to these dependency changes.

Approved for this scope.

[portdeveloper]

@nishuzumi Moss #196 now has pillowtalk-Qy's approval on the current head. I checked the dependency diff and its registry integrities; hosted lint/build/typecheck and Windows offline tests pass. Linux still stops at the expired Aave quarantine in #185/#195, before the later packages run. Please finish the required validation and merge review once that gate is repaired. #198 is also waiting for your designated review: #196 #198