chore: npm audit fix — bump brace-expansion + ws transitive devDeps

Two moderate-severity advisories landed in the GitHub Advisory Database
between 2026-05-18 and 2026-05-20, breaking `npm audit` on every PR
that ran CI in that window (#87, #90, #91, #92, #94 plus dependabot).
Diagnosis: CI failures show on PRs with trivial diffs (e.g. #94 is a
1-line .gitignore) → failure is in the baseline, not the PR diffs.

- brace-expansion 5.0.5 → 5.0.6 — DoS in numeric range (GHSA-jxxr-4gwj-5jf2)
- ws 8.20.0 → 8.20.1 — uninitialized memory disclosure (GHSA-58qx-3vcg-4xpx)

Both are dev-only transitive deps. Patch-level bumps, no public-API
ripple. `npm audit fix` produces the minimal lockfile delta.

Verified locally:
- npm audit: 0 vulnerabilities
- format:check, lint, build, typecheck, test:coverage all green
- lint:pkg still fails on publint sideEffects suggestion — distinct
  baseline issue addressed by PR #88 (queue #70)

Closes the npm-audit half of envelope #23.

Author: Goosterhof