[codex] Remediate Klix js-yaml advisory

[nahremenkova1]

Summary

• updates the Klix js-yaml override from 4.3.0 to 4.3.1
• adds an npm override for nanoid 3.3.17 to remediate GHSA-2v37-7h3g-55p8
• refreshes package-lock.json so npm audit no longer reports the reviewed advisories

Verification

• npm audit --audit-level=moderate: passed, found 0 vulnerabilities
• npm test: passed, 4 files / 14 tests
• npm run typecheck: passed
• npm run build: passed

Follow-up from OPE-1965 daily SDK review.

[nahremenkova1]

QA Sign-Off

Recommendation: merged

Validation:

• GitHub CI: green before merge (Unit Tests and CodeQL completed successfully on dd5230f).
• Local matrix: npm ci, npm audit --audit-level=moderate, npm test (4 files / 14 tests), npm run typecheck, npm run build all passed.
• Diff review: package.json/package-lock.json only; js-yaml override moved to 4.3.1 and nanoid override added at 3.3.17.
• Security hold: no PR comments and no SECURITY-HOLD found.
• Coverage: no coverage script/report present in this repo, so no measurable coverage drop was detected.
• Repo QA docs: agents/qa-agent.md and specs/21-task-completion-and-blockers.md were not present on default or PR branch; applied the task-level validation holds.

Merged via squash: 32cb696