security: patch desktop updater js-yaml parser

[aiis2]

Summary

• refresh the shared js-yaml lock node used by electron-updater from 4.1.1 to 4.3.0
• add a desktop-owned installed-graph contract requiring electron-updater -> js-yaml to remain >=4.3.0 <5
• record RED/GREEN, lock-scope, reconstruction, repository-gate, and official-audit evidence

Why

Issue #34 tracks one high and one moderate js-yaml advisory on the production dependency path:

@risk-agent/desktop -> electron-updater@6.8.3 -> js-yaml@4.1.1

Current release artifacts keep updater publishing disabled, so the path is latent today. Retaining the affected parser would make the risk immediately relevant when publishing is enabled. electron-updater already accepts js-yaml@^4.1.0, so replacing only the compatible shared lock node is narrower than upgrading electron-updater, adding a direct dependency, or introducing a workspace override.

Specification: #35

Verification

• RED commit 114c62a: package-anchored resolution reached js-yaml 4.1.1 and failed only below the 4.3.0 floor
• GREEN commit 2c3525b: the unchanged contract resolved js-yaml 4.3.0 and passed
• lock scope: 9 hunks, 10 additions / 10 deletions, one package/integrity node, seven parent references, one snapshot key
• focused desktop tests: 3 files / 12 tests
• full repository tests: 105 files / 545 tests
• clean typecheck, typecheck, lint, workspace build, and diff checks passed
• exact-path offline frozen reconstruction restored 1,071 packages with zero downloads; focused and full gates passed again
• initial official production audit: 0 critical, 1 high, 11 moderate, 2 low, 14 advisory records, 654 dependencies, zero js-yaml records
• 2026-07-25 integration audit refresh: 0 critical, 5 high, 14 moderate, 2 low, 21 advisory records, 654 dependencies, zero js-yaml records; Issue security: patch the desktop updater's js-yaml parser #34 and both plans record the seven new unrelated advisories

Pending Integration Gates

• independent specification-compliance and code-quality review
• repeat isolated frozen verification after the audit-refresh documentation commit
• native Windows, macOS, and Linux release workflow with three non-empty artifacts and zero annotations

Closes #34