chore: resolve dependabot security alerts

[MarshallOfSound]

Safe-only sweep of open Dependabot security alerts. All changes are lockfile-only (yarn up -R) and stay within existing semver ranges — no package.json edits, no resolutions.

Package	Strategy	Version change
brace-expansion	yarn up -R (transitive, within ^2.0.2)	2.0.2 → 2.0.3
yaml	yarn up -R (transitive, within ^2.8.1)	2.8.2 → 2.8.3 (dedup'd with direct ^2.8.3)
picomatch	yarn up -R (transitive, within ^2.3.1)	2.3.1 → 2.3.2
picomatch	yarn up -R (transitive, within ^4.0.3)	4.0.3 → 4.0.4
tar	yarn up -R (transitive, within ^7.4.3)	7.5.10 → 7.5.13

Flagged (not changed)

• lodash (2 alerts, GHSA-r5fr-rjxr-66jc / GHSA-f23m-r3pf-42rh) — the only patched release is 4.18.0, published 2026-03-31, which does not yet satisfy this repo's npmMinimalAgeGate: 10080 (7 days). Left as-is; a follow-up yarn up -R lodash once the version ages past the gate will resolve it without any range changes (jsonwebtoken already allows ^4.17.21).

Verification

• yarn install --immutable passes
• yarn npm audit --all --recursive --no-deprecations: 7 → 2 advisories (remaining 2 are the flagged lodash items above)
• No new peer-dependency warnings introduced (pre-existing @types/node warning is unrelated)