fix(opencode): upgrade js-yaml to 4.3.1

[Kerberosmansour (kerberosmansour)]

Summary

• raise the OpenCode package's transitive js-yaml override from 4.2.0 to 4.3.1
• regenerate the lockfile and verify that production dependency audit findings are cleared
• add a dependency audit record with rationale, validation, compatibility, and rollback notes

Security rationale

Version 4.3.0 addresses GHSA-52cp-r559-cp3m, but remains affected by GHSA-5p4m-2wfm-xmqj. Version 4.3.1 is therefore the first 4.x release that resolves both high-severity quadratic-CPU advisories.

Validation

• cd agent-governance-opencode && npm run check — 25/25 tests passed
• cd agent-governance-opencode && npm audit --omit=dev — 0 vulnerabilities
• documentation link and frontmatter checks passed
• changed-line spelling and whitespace checks passed

Closes #3671

Tracking

• Primary issue: [Security]: upgrade js-yaml to 4.3.1 or remove it from the OpenCode path #3671; the closure directive above remains authoritative.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	MEDIUM
Overall	MEDIUM

Automated check by AGT Contributor Check.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Imran Siddique (imran-siddique)]

Checked your advisory reasoning against the GitHub Advisory Database rather than taking it, because I had pulled the same data earlier today for a different js-yaml audit and wanted to be sure the two agreed.

They do, and the distinction you drew is the one that matters:

• GHSA-52cp-r559-cp3m — affects >= 4.0.0, < 4.3.0, first patched 4.3.0
• GHSA-5p4m-2wfm-xmqj — affects >= 4.0.0, < 4.3.1, first patched 4.3.1

So 4.3.1 is the first 4.x release clearing both, and 4.3.0 would have looked sufficient to anyone who stopped at the first advisory. Getting that right is the whole value of the change. Including the audit doc with rollback notes rather than leaving it for someone else is the other half.

The red Validate docs frontmatter is not yours. scripts/docs/check_frontmatter.py --root . scans the whole repository, and the finding is:

[error] docs/security/audits/2026-07-31-fail-open-closure-python-reference.md: missing frontmatter block

Your PR does not touch that file. It was fixed by #3619, which merged today at 18:46, and your branch's last commit is from 2026-08-10, so it predates the fix. I ran the gate against current main: 279 files scanned, 0 findings.

A rebase onto main clears it with no change to your work. Any branch cut before today that touches docs/ inherits the same failure, which is also why dependabot #3598 is currently red on this exact check.

Your own doc's frontmatter is fine, for what it is worth: title, last_reviewed and owner are all present and correctly formed.

No approve bit on this repo, so this is a comment, but once it is rebased I would merge it.