Fix js-yaml vulnerability and publish standards 0.6.3

[dudetru25]

Summary

• update the locked transitive js-yaml dependency from 4.3.0 to 4.3.1
• close Dependabot alert #73 / GHSA-5p4m-2wfm-xmqj
• include the existing standards 0.6.3 policy commit already present on the fix branch

Security invariant

Untrusted YAML processed by development tooling must not use a js-yaml release vulnerable to quadratic CPU consumption during !!omap resolution.

Validation

• npm ci --ignore-scripts --min-release-age=7
• npm run validate
• 205 tests passed across runtime, simplified-context, and remote-shell suites
• npm audit reported 0 vulnerabilities

The locked version was published on 2026-07-31 and satisfies the repository seven-day package-age gate.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}