fix(deps): update fast-uri audit floor

[BenSheridanEdwards]

Why does this feature exist?

All pull requests currently fail the Node 22 dependency-audit job because fast-uri 3.1.4 is covered by GHSA-7p8r-x3mc-p8w7. The affected package is transitive development tooling, but the audit gate correctly blocks merges until the lockfile resolves the patched version.

What changed?

• Update the locked transitive fast-uri dependency from 3.1.4 to 3.1.5.
• Record the audit repair in the unreleased changelog.
• Do not change runtime dependencies or application source.

Behavioural Proof (with video and screenshots)

Not applicable: this is a development-dependency lockfile repair. npm ls fast-uri --all resolves 3.1.5 and npm audit --audit-level=high reports zero vulnerabilities.

Verification Summary

• Definition of Done: followed .agents/project/DEFINITION_OF_DONE.md.
• Commands run: clean npm ci; npm ls fast-uri --all; npm audit --audit-level=high; build; typecheck; lint; format check; git diff --check.
• Results: clean install resolves fast-uri@3.1.5; audit reports zero vulnerabilities; all source checks pass.
• Known risks or skipped checks: full product tests are unchanged by this lockfile-only development-dependency update; the pre-push hook and hosted matrix run them before merge.

Checklist

• Proof above — clean install and audit commands prove the repaired dependency floor
• Report rendering is unchanged; demo regeneration is not applicable
• Build, typecheck, lint and format checks pass
• Hosted matrix and pre-push suite provide full test coverage
• No product test change is needed for a transitive lockfile-only repair
• Updated the CHANGELOG
• Captured output is unchanged; adopters do not need to regenerate baselines
• Followed .agents/project/DEFINITION_OF_DONE.md
• Visual proof is not applicable because no rendered behavior changed
• The PR body contains no local paths, private consumer references, or placeholders

[github-actions]

🗺️ StyleProof report

📊 View the side-by-side visual report →

---

Coverage, determinism, or report/diff consistency evidence is incomplete — repair the capture or reflow source; visual approval cannot clear this failure.