build(deps): patch development dependency DoS

[GSTJ]

Summary

Patch the development dependency graph without forcing Metro onto an unsupported image-size major.

Details

• Resolves js-yaml at 3.15.1 and 4.3.1, and Nano ID at 3.3.18.
• Backports the ICNS and ISO media box guards to image-size 1.2.1, with child-process watchdogs covering direct parser and Metro asset paths.
• Runs the parser and version regressions before Jest in CI and release jobs. The package audit ignores only the two image-size advisories without an upstream fixed release.
• Leaves runtime source and dependency declarations unchanged.

Testing steps

1. Install the repository dependencies:

   pnpm install --frozen-lockfile

   It should finish without edits.

2. Exercise the CI test path and the dependency audit:

   pnpm run test --runInBand
   pnpm run security:check

   Both commands should exit 0.

[GSTJ]

Local verification of the dependency regressions, audit result, and packed-plugin Expo prebuild:\n\n