fix(deps): resolve 3 js-yaml Dependabot alerts (js-yaml 4.1.1 -> 4.3.1)

[DeepDiver1975]

Resolves all three open Dependabot alerts on this repo. They are all the same
package: the transitive js-yaml 4.x copies that Antora nests under three of
its packages.

Fixed

Package	Alert(s)	Before	After	Needs	Scope
js-yaml (under @antora/content-aggregator)	#10, #9, #8	4.1.1	4.3.1	≥ 4.3.1	transitive
js-yaml (under @antora/playbook-builder)	#10, #9, #8	4.1.1	4.3.1	≥ 4.3.1	transitive
js-yaml (under @antora/ui-loader)	#10, #9, #8	4.1.1	4.3.1	≥ 4.3.1	transitive

• chore(deps): Bump actions/checkout from 4 to 6 #10 (high) — quadratic CPU consumption in !!omap resolution; CVE-2026-59870 fix not backported. Needs ≥ 4.3.1.
• chore(deps): Bump peter-evans/create-pull-request from 6 to 8 #9 (high) — YAML merge-key chains can force quadratic CPU consumption. Needs ≥ 4.3.0.
• feat(sync): scheduled upstream-sync that opens PRs per source repo #8 (medium) — quadratic-complexity DoS in merge key handling via repeated aliases. Needs ≥ 4.2.0.

4.3.1 clears all three thresholds.

Why per-parent overrides instead of one pin

Two major lines of js-yaml are live in this tree at once:

• the direct dependency is already ^5.3.0 → resolves to 5.3.0, which is not in any vulnerable range;
• the transitive copies under the three @antora/* packages were 4.1.1.

A blanket "js-yaml": "4.3.1" override would have downgraded the healthy 5.x
direct dependency onto the 4.x legacy line, so the pin is scoped per parent and
the root dependency is left at 5.3.0.

The three Antora packages declare "js-yaml": "~4.1", which cannot reach 4.3.1
on its own, and Antora's latest stable release (3.1.15) is already in use —
only 3.2.0 pre-releases exist upstream. Overrides are therefore the only way to
the patched version without adopting a pre-release Antora. (4.3.1 is published
upstream under the v4-legacy dist-tag.)

Not fixable

None — all three alerts have an upstream fix and it is applied here.

Test plan

Run under Node 22, matching .github/workflows/ci.yml (the local default is
Node 18, which several deps no longer support):

• npm ci — clean install from the lockfile, 0 vulnerabilities
• resolved versions re-checked per consumer: all three nested copies are 4.3.1, root stays 5.3.0
• npm run antora — exit 0, public/index.html produced
• npm test — 17/17 pass
• npm run pagefind — exit 0, 486 pages indexed

The 29 xref not found errors in the Antora log are pre-existing on main
(stale next@ocis:ROOT: targets, last touched by a docs-main sync) and are
non-fatal — no failure_level is set in site.yml.

Note for reviewers

The alerts stay open on the security page until this merges into main; that is
expected and not a sign the fix did not take.

🤖 Generated with Claude Code