chore(deps): consolidate open Dependabot updates (Jul 2026)

[fgalz]

Summary

• Bump js-yaml 5.2.1 → 5.2.2 and openai 6.45.0 → 6.49.0
• Pin transitive patch updates via overrides: webpack-dev-server 5.2.6, shell-quote 1.10.0, fast-uri 3.1.4, dompurify 3.4.12, websocket-driver 0.7.5
• Supersedes Dependabot PRs Bump js-yaml from 5.2.1 to 5.2.2 #1832, Bump webpack-dev-server from 5.2.5 to 5.2.6 #1831, Bump shell-quote from 1.8.4 to 1.10.0 #1830, Bump fast-uri from 3.1.2 to 3.1.4 #1829, Bump dompurify from 3.4.11 to 3.4.12 #1828, Bump openai from 6.45.0 to 6.48.0 #1826, Bump websocket-driver from 0.7.4 to 0.7.5 #1825, Bump mermaid from 11.15.0 to 11.16.0 #1819, Bump webpack from 5.108.3 to 5.108.4 #1817, Bump js-yaml from 5.2.0 to 5.2.1 #1816

Test plan

• npm run build -- --locale en succeeds locally
• CI build passes for remaining locales
• Docusaurus dev server starts without errors

[fgalz]

Superseded by #1843 — closing in favor of the Aug 2026 consolidate PR.