chore(renovate): cap js-yaml below v5 while front-matter is an Analog peer

[BryanFRD]

Renovate opened the same js-yaml v5 PR on FerrTrack-Cloud, FerrVault-Cloud and FerrFleet-Cloud. All three break the site build:

failed to load config from site/vite.config.ts
TypeError: loader is not a function
    at parse (node_modules/.pnpm/front-matter@4.0.2/node_modules/front-matter/index.js:64:20)

@analogjs/content requires front-matter: ^4.0.2 as a peer, and that package pins js-yaml ^3.13.1. GHSA-2883-xcg3-v3hh is patched on each line (3.15.2, 4.3.2), so the trees are already remediated and there is nothing v5 buys. v5 also has GHSA-pm4m-ph32-ghv5 open below 5.2.2.

The three PRs are closed; this stops them coming back.

[ferrfleet]

JSON parses, the rule is well formed, exact-matches js-yaml only, and sits where no later rule clobbers allowedVersions. One blocking question inline about whether the cap survives the vulnerability-alert path it is meant to stop.

Nit: this caps js-yaml for every npm repo in the org to fix three Analog sites. Any other repo that takes a direct js-yaml dependency is silently stuck on 4.x with nothing surfacing why, and the "lift this when Analog drops front-matter" note has no reminder attached to it. matchRepositories on this rule, listing the three Cloud repos, keeps the blast radius on the repos that actually have the broken peer. Not listing the exact names as a suggestion block since those repos are not visible from here.

[ferrfleet]

The vulnerability-alert question from the last round is answered and resolved. One new blocking finding inline, on a line I already looked at once: the cap lets 4.x through, and js-yaml 4 fails front-matter@4.0.2 the same way v5 does.

[ferrfleet]

4597246 fixes the v4 gap and the depType scoping is the better shape: pnpm-workspace.overrides is the real extractor string, and holding the override entries on 3.x while direct js-yaml deps move freely resolves the blast-radius tradeoff properly rather than trading one break for another.

One blocking finding inline on the new matchDepTypes list: pnpm.overrides (the package.json spelling for pnpm) is a distinct depType from overrides and isn't listed, so the fallback you described in the last round isn't actually covered.

[ferrfleet]

16dfa3e closes the last blocking finding (one line, pnpm.overrides added to matchDepTypes, nothing else touched). All three findings from the earlier rounds are resolved, JSON still parses and the rule still sits where no later rule overwrites allowedVersions. Approving.

Nit: the PR title still says "cap js-yaml below v5"; the rule is <4. Worth fixing in the squash message so the commit on main matches what it does.