fix(deps): re-resolve svgo + fast-xml-parser + fast-uri to clear osv-scanner blocking the merge queue

[isadeks]

Summary

osv-scanner (required check Secrets, deps, and workflow scan → Dependency scan (osv-scanner)) fails on main's yarn.lock, which blocks the merge queue for every PR — the merge_group re-scan runs against the latest main and ejects any queued PR. Same class as #636 (astro/brace-expansion), just new advisories: these were published after the affected PRs were last scanned, so PR-open checks were green while the re-scan is red. Currently observed on #612 and #616.

Affected packages (from osv-scanner scan --lockfile agent/uv.lock --lockfile yarn.lock)

OSV	CVSS	Ecosystem	Package	Version	Fixed
GHSA-2p49-hgcm-8545	8.2	npm	svgo	4.0.1	4.0.2
GHSA-8r6m-32jq-jx6q	8.7	npm	fast-xml-parser	5.9.3	5.10.1
GHSA-v2hh-gcrm-f6hx	7.5	npm	fast-uri	3.1.3	3.1.4

All three fix versions are clean in OSV. svgo and fast-uri are transitive; fast-xml-parser is a direct dep at ^5.7.0 — and 5.10.1 is within that caret, so all three are a lockfile-only re-resolve (no manifest/version-string change).

Fix

Re-resolve all three in the root yarn.lock within their existing ranges:

• svgo 4.0.1 → 4.0.2
• fast-xml-parser 5.9.3 → 5.10.1
• fast-uri 3.1.3 → 3.1.4

Then mise run security:deps must exit 0.

Acceptance criteria

• mise run security:deps (osv-scanner) exits 0 on the branch.
• svgo 4.0.2, fast-xml-parser 5.10.1, fast-uri 3.1.4 in the root yarn.lock.
• No functional/source changes and no package.json changes — yarn.lock only.
• yarn install --frozen-lockfile consistent; mise //docs:build green.