fix(deps): patch js-yaml merge-source denial of service

[berkay-byte]

Fixes #2358.

js-yaml@3.14.2 is affected by CVE-2026-84375 / GHSA-2883-xcg3-v3hh: empty YAML merge sources bypass the merge-key budget and can exhaust CPU. Raise the direct devDependency floor to ^3.15.2 and update both npm lockfiles to the patched 3.x release. This also updates the copy shared with the Jest/Babel toolchain without a major-version migration.

Add regression coverage that rejects empty merge sources exceeding a small budget and accepts ordinary merges within the budget. Exposure here is in development/spec-generation tooling; this PR does not claim a reachable production exploit.

Validation on Windows / Node 24:

• Clean npm ci --ignore-scripts succeeded; installed js-yaml is 3.15.2.
• Core TypeScript check passed (tsc -p core/tsconfig.json --noEmit).
• Core Jest: 823 passed, 3 already skipped, with pmxt-ensure-server.test.ts excluded. The full run otherwise passes after local LF normalization; that launcher test assumes Unix HOME/PATH and executable-script behavior and fails on Windows.
• TypeScript SDK: 49 tests passed; 10 suites could not compile because the ignored generated/src/index.js client is absent in a fresh clone. The local environment has no Java runtime for OpenAPI generation.
• Installed the missing Windows resolver binding locally to run Jest; no platform-specific dependency/config changes are included.

Other npm audit findings remain outside this focused fix. Full Linux/integration verification is still needed before merge.

Advisory: GHSA-2883-xcg3-v3hh