chore: clear npm audit warnings (#37)

* chore: clear npm audit warnings

- Replaces deprecated vercel/pkg (^5.8.1) with maintained fork
  @yao-pkg/pkg (^6.6.0). vercel/pkg has an unfixed local privilege
  escalation advisory (GHSA-22r3-9w55-cj54) and is no longer maintained.
- Bumps @typescript-eslint/{eslint-plugin,parser} from ^6.11.0 to ^8.59.3
  to clear minimatch advisories.
- npm audit fix updates other transitive deps.

Resolves 12 vulnerabilities (1 low, 4 moderate, 7 high) → 0.
Build succeeds. Pre-existing ts-node module resolution test error on
main is unrelated to this change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people