fix(security): bump vulnerable transitive dev deps to patched versions

[rlorenzo]

Summary

Patches the 5 open high-severity Dependabot alerts. All are transitive dev-only dependencies (build/lint/test tooling), never shipped to the browser bundle or the .NET runtime.

Dependabot alert	Package	Fix
#142	shell-quote (root)	overrides to 1.10.0 (concurrently pins exact 1.8.4, so npm update can't lift it)
#141	js-yaml (root)	npm update to 4.3.0
#137	shell-quote (VueApp)	overrides to 1.10.0
#136, #134	brace-expansion (VueApp)	npm update to 2.1.2 / 5.0.7

All are DoS / quadratic-complexity (ReDoS-style) advisories. Exploitation requires feeding attacker-controlled input to the vulnerable parser, which does not happen in dev tooling.

Intentionally not included

undici (VueApp, via @codecov/vite-plugin) is flagged by npm audit but is not an open Dependabot alert. GitHub already auto-dismissed its advisories as low-impact dev-only, so it is left out to keep this scoped to the open alerts.

Why only shell-quote needed an override

concurrently pins shell-quote to an exact 1.8.4 (no caret), so npm cannot float it to a patched version. overrides is the correct lever. js-yaml and brace-expansion moved via plain npm update because their parents use caret ranges.

Verification

• npm audit: root 0 vulnerabilities; VueApp 1 remaining (the auto-dismissed undici).
• Pre-commit hook: LINT + TEST + VERIFY all passed.
• Lockfile churn is limited to exactly these packages, no unrelated bumps.