fix(deps): bump pinned undici→7.29.0, js-yaml→4.3.1 (clear 2 High CVEs)

Same 2 pre-existing High CVEs as #137 (undici 7.28.0 GHSA-4cwx-7wf7-3272, js-yaml 4.3.0 GHSA-5p4m-2wfm-xmqj) in main's pinned deps — not introduced by the typescript 6→7 bump. Bumping the override floors clears them. Local gate green: osv + typecheck + build + test.

Author: liveapp-bot

package.json

@@ -31,12 +31,12 @@
   "pnpm": {
     "overrides": {
       "form-data": ">=4.0.6",
-      "undici": ">=7.28.0",
-      "jsdom>undici": ">=7.28.0 <8",
+      "undici": ">=7.29.0",
+      "jsdom>undici": ">=7.29.0 <8",
       "ws": ">=8.21.0",
       "vite": ">=6.4.3",
       "read-yaml-file@1": "^2.1.0",
-      "js-yaml@4": "^4.3.0",
+      "js-yaml@4": "^4.3.1",
       "esbuild": ">=0.28.1",
       "sharp": ">=0.35.0"
     }