[codex] Remediate js-yaml Dependabot alert

[nahremenkova1]

Summary

• remove the vulnerable transitive js-yaml path by upgrading the ESLint toolchain to the current flat-config stack
• add eslint.config.mjs and retire the legacy ESLint config files
• keep Node 18 runtime coverage via a dist artifact built on Node 20.19 while dev-tool CI runs on supported Node versions

Validation

• npm ci
• node lockfile check: js-yaml absent from package-lock
• npm audit --audit-level=high
• npm run lint
• npm run typecheck
• npm test (13 files / 187 tests)

Dependabot alert #97 is still open on the default branch until this remediation is merged and GitHub re-scans package-lock.json.