Fix vulnerable markdown dependencies

[brianvarskonst]

Summary

• Force markdown-it to the patched 14.2.0 release via npm overrides
• Force js-yaml to 4.2.0 so npm audit remains clean while markdownlint-cli2 keeps exact transitive pins
• Refresh package-lock.json

Verification

• npm ci
• npm ls markdown-it js-yaml --all
• npm audit --audit-level=moderate
• npm run test:contracts
• npm run lint:docs
• npm run doctor -- --fail-on high fixtures/wp-plugin
• npm run doctor:repo
• npm run lint:workflows