chore(deps): bump js-yaml to 4.3.1 in sim-cli and drop the aged-out release-age waivers (#6784)

js-yaml < 4.3.1 has quadratic CPU consumption in !!omap resolution
(GHSA-5p4m-2wfm-xmqj / CVE-2026-59870). sim-cli builds with
--packages=bundle, so its dev-scoped js-yaml is bundled into the
published CLI. 4.3.1 is already what apps/sim pins, so this collapses
sim-cli onto the hoisted copy.

The minimumReleaseAge waivers for js-yaml and mermaid were temporary
and have both aged past the 7-day window; leaving them behind would
disable the supply-chain gate for those packages indefinitely.

Author: waleedlatif1

bun.lock

@@ -53,7 +53,7 @@
     "@xterm/headless": "6.0.0",
     "chalk": "5.6.2",
     "commander": "^11.1.0",
-    "js-yaml": "4.3.0",
+    "js-yaml": "4.3.1",
     "typescript": "^7.0.2",
     "vitest": "^4.1.0"
   }