fix(deps): bump markdownlint-cli2 to 0.23.2 to clear npm audit failure

[sumitake]

Advisories addressed

CI's npm audit --audit-level=moderate step (in the node matrix job) was failing on all three Node versions (20/22/24) with exit 1, since the js-yaml dependency pulled in transitively by markdownlint-cli2@0.23.0 was affected by two advisories:

Package	Severity	Direct/Transitive	Advisory	Fix available
js-yaml (5.0.0-5.2.1)	high	transitive (via markdownlint-cli2 -> js-yaml)	GHSA-pm4m-ph32-ghv5 — exponential parsing time DoS	yes, non-major
js-yaml (5.0.0-5.2.0)	moderate	transitive (via markdownlint-cli2 -> js-yaml)	GHSA-724g-mxrg-4qvm — O(n^2) DoS via !!omap tag	yes, non-major
markdownlint-cli2	moderate (rollup)	direct devDependency	rollup of the js-yaml advisories above	0.23.0 -> 0.23.2, non-major

Remediation chosen

Targeted, semver-compatible bump: markdownlint-cli2 devDependency 0.23.0 -> 0.23.2 (patch release). This pulls in a patched js-yaml@5.2.2 transitively along with a few other patch/minor bumps in markdownlint-cli2's own dependency tree (globby, markdown-it, markdownlint). No direct runtime dependency changes, no code changes required — this is dev-tooling only (the markdown linter used in CI). Did not run npm audit fix --force; the fix was applied deliberately via package.json + regenerated package-lock.json.

This is the same fix already proposed by the repo's own Dependabot as PR #12 (dependabot/npm_and_yarn/markdownlint-cli2-0.23.2) — independently arrived at via npm audit's reported fixAvailable. Merging this PR should cause Dependabot to auto-close #12 as satisfied; otherwise it can be closed manually as a duplicate.

Test evidence (local, Node v26.6.0 — closest available to the CI matrix of 20/22/24)

$ npm ci --ignore-scripts
added 146 packages, and audited 147 packages
found 0 vulnerabilities

$ npm run check   # node --check + node --test (20/20 tests pass)
ℹ tests 20
ℹ pass 20
ℹ fail 0

$ npm run lint:markdown
markdownlint-cli2 v0.23.2 (markdownlint v0.41.1)
Summary: 0 issues in 0 files

$ npm audit --audit-level=moderate
found 0 vulnerabilities

$ npm pack --dry-run
total files: 49, package size: 40.1 kB   # unchanged contents

All steps of the CI node job (checkout, setup-node, npm ci --ignore-scripts, npm run check, npm run lint:markdown, npm audit --audit-level=moderate, npm pack --dry-run) now pass locally. CI will additionally validate against the full Node 20/22/24 matrix, which was not available locally (only Node 26 installed).

Nothing requiring an operator decision

Both advisories had a genuine, non-major, dependency-only fix available, so no audit-gate weakening or operator judgment call was needed.