fix(deps): resolve August Dependabot alerts

[dizhaky]

Summary

• bump js-yaml 4.3.0 → 4.3.1 and nanoid 3.3.16 → 3.3.17 in the docs site
• bump transitive h2 4.3.0 → 4.4.1 and exempt security patches from the 14-day release-age gate
• exempt the two npm security patches from the docs-site release-age gate

Risk disposition

• image-size 2.0.2 has two high alerts and no patched npm release
• dependency is build-time-only through Docusaurus MDX and processes repository-controlled docs assets, not untrusted runtime input
• alerts fix: repair the Python suite so the aggregate gate can go live #187 and feat(cron): auto-pause after consecutive failures + orchestration playbook #188 were dismissed as not_used with this rationale

Verification

• uv lock --check
• docs npm ci --ignore-scripts
• full multilingual Docusaurus production build passed
• git diff --check

Resolves Dependabot alerts #183, #184, and #186 after GitHub rescans the merged locks.

[dizhaky]

Superseded by a clean rebased branch because #157 landed overlapping npm fixes while this PR was being prepared.