fix(deps): dedupe js-yaml so no 4.3.1 copy remains in the tree

Pinning the two direct dependents to 4.3.2 left nine transitive
consumers pinned to their own nested 4.3.1, because bun does not
re-resolve a lockfile entry that still satisfies its range. The tree
therefore kept a vulnerable copy of the package the previous commit
was meant to remove.

Every one of those consumers asks for ^4.1.x, which 4.3.2 satisfies, so
the nesting was lockfile inertia rather than a real constraint. Dropping
the stale entries and reinstalling lets them all resolve to the single
hoisted 4.3.2. The two js-yaml 3.x consumers, artillery and gray-matter,
keep their own copy untouched.

Done this way rather than by deleting the lockfile, which re-resolves
every floating range and churned 1130 unrelated lines, or by a global
override, which would force v4 onto those two v3 consumers. This diff
removes nine lines and changes nothing else.

Verified: js-yaml 4.3.1 no longer resolves anywhere in the tree, the
docs site still builds its 700+ pages through fumadocs, and the desktop
suite covering electron-updater passes its 1600 tests.

Author: waleedlatif1