Apply non-breaking npm audit fixes and document force-only remediation path

[Copilot]

Ran npm audit fix without overrides or --force to apply all non-breaking dependency remediations, and captured the remaining vulnerabilities that require a force upgrade path.

• Lockfile updates (non-breaking)

  • Updated package-lock.json with audit-resolved transitive versions (no package.json changes).

• Remaining force-only vulnerabilities

  • Remaining advisories are in the ava -> supertap -> js-yaml chain.
  • NPM reports full remediation requires npm audit fix --force, which would install ava@0.24.0 (semver-major path).

• Audit output (force requirement)

  js-yaml <=4.1.1
  fix available via `npm audit fix --force`
  Will install ava@0.24.0, which is a breaking change

Original prompt

Run npm audit fix. No overrides. No force flags. List which dependencies would require a force flag to resolve. Create a PR.

Created from VS Code.