security: bump js-yaml to 4.3.1 (GHSA-5p4m-2wfm-xmqj)

[wintonzheng]

Problem

Dependabot alert #1 (high, GHSA-5p4m-2wfm-xmqj) reports js-yaml 4.3.0 in node/package-lock.json. The vulnerable range is >= 4.0.0, < 4.3.1.

Solution

Bump js-yaml to 4.3.1 in the lockfile.

js-yaml is not a direct dependency — it arrives transitively through @napi-rs/cli, which is a devDependency used for building the Node bindings. The consuming range already permits 4.3.1, so this is a lockfile-only change: no manifest edit and no override needed.

Blast radius is limited to the build toolchain; nothing in the published rustwright package depends on js-yaml at runtime (files ships only the prebuilt .node/.cjs/.mjs artifacts).

How Has This Been Tested?

• npm update js-yaml --package-lock-only produced a 3-line lockfile change (version, resolved, integrity) with no tree restructuring.
• Verified the resolved version moved 4.3.0 → 4.3.1 and that no other package entry changed.
• CI on this PR is the enforcement point for the build itself.

Closes the repo's only open Dependabot alert.

[claude]

Summary

Clean, minimal security fix — lockfile-only bump of js-yaml 4.3.0 → 4.3.1 to close GHSA-5p4m-2wfm-xmqj. Verified js-yaml is a transitive devDependency (via @napi-rs/cli's ^4.2.0 range in node/package-lock.json, not node/package.json), so no manifest edit was needed and the range already permitted 4.3.1. Diff is exactly the expected 3-line lockfile change (version/resolved/integrity), scoped to the build toolchain with no runtime impact on the published package. No concerns with correctness, FFI, CDP, or API surface — none of those are touched here.

LGTM.