Update vulnerable documentation-tooling transitive dependencies #396

Part of #382 — v1.0.0 alpha readiness.

Review audit results

At ebe9cca601fb85e6064c786367e546ded9b07d05, npm audit reported two moderate development-tooling vulnerabilities with fixes available:

• mdast-util-to-hast@13.2.0: GHSA-4fh9-h7wg-q85m, unsanitized class attribute; patched range begins at 13.2.1. Lock entry: package-lock.json:4117-L4119.
• postcss-selector-parser@6.1.4: GHSA-rj75-hqrm-r3gf, quadratic selector parsing/CPU exhaustion; patched range begins at 6.1.5. Lock entry: package-lock.json:5038-L5040.

npm audit --omit=dev reported zero vulnerabilities. These findings affect development/documentation tooling, not shipped browser runtime dependencies.

Acceptance criteria

• Update the relevant dependency chain/lockfile to patched compatible versions; avoid a broad forced major-version upgrade as the default fix.
• Confirm a fresh npm ci succeeds.
• Rerun npm audit and npm audit --omit=dev; the two identified advisories are resolved, with any unrelated/new findings explicitly triaged.
• Formatting, ReScript build, feature checks, runtime tests, and documentation build still pass.
• Do not add consumer runtime dependencies merely to fix documentation tooling.