fix: override gray-matter js-yaml advisory

[ProfTrader]

Summary

• add a pnpm workspace override so gray-matter resolves its transitive js-yaml dependency to 4.2.0
• add a tiny pnpm dependency patch for gray-matter@4.0.3 so its default YAML engine uses js-yaml 4's load / dump APIs, with fallback support for the old names
• remove the vulnerable js-yaml@3.14.2 / argparse@1 / sprintf-js dependency path from the lockfile

Verification

• npx pnpm@11.5.2 install --ignore-scripts --config.confirmModulesPurge=false
• npx pnpm@11.5.2 audit --prod --json reports 0 vulnerabilities
• npx pnpm@11.5.2 exec vitest run src/utils/frontmatter.test.ts src/utils/content-equivalence.test.ts --silent=true
• npx pnpm@11.5.2 run typecheck
• git diff --check