chore(deps): upgrade npm toolchain and remediate alerts

[jrepp]

Summary

• remediate all five open Dependabot alerts for transitive ESLint dependencies
• upgrade the development toolchain to Node.js 26.7.0, npm 12.0.2, and ESLint 10.8.1
• migrate the legacy ESLint configuration to flat config
• pin and enforce the development runtime and package-manager versions
• add an offline lockfile regression test for known vulnerable dependency floors
• update CI and release workflows to use the pinned toolchain and reproducible npm ci installs
• add a pull-request dependency gate for toolchain pins, direct dependency freshness, audit status, and security regressions

Why

The committed lockfile resolved vulnerable versions of brace-expansion, js-yaml, flatted, and minimatch. A local audit also identified vulnerable ajv. The existing ESLint 8 and Node.js 18 CI setup was outdated and kept the vulnerable transitive dependency graph in place.

Impact

All direct npm development dependencies are now at their latest releases and npm audit reports no vulnerabilities. This intentionally raises the package's minimum supported Node.js version from 12 to 26.7.0 and requires npm 12.0.2 for repository development.

Validation

• clean npm ci under Node.js 26.7.0 and npm 12.0.2
• npm test
• npm run test:api
• npm run validate
• npm audit --audit-level=moderate (0 vulnerabilities)
• npm outdated --depth=0 (no outdated direct dependencies)
• git diff --check
• GitHub Actions pull-request run (all jobs passed)