fix(security): patch DOI validation dependency advisories (#98)

## Security and quality patch

Updates the isolated DOI-contract test toolchain to patched releases for
both open Dependabot alerts:

- **ajv** `8.17.1` → `8.18.0`, patched for
[GHSA-2g4f-4pwh-qvx6](GHSA-2g4f-4pwh-qvx6)
(ReDoS when `$data` is enabled).
- **yaml** `2.8.2` → `2.8.3`, patched for
[GHSA-48c2-rrv3-qjmp](GHSA-48c2-rrv3-qjmp)
(stack overflow on deeply nested collections).
- Adds a Bun/npm `overrides.ajv` pin. A refreshed Bun lock initially
retained `ajv@8.17.1` nested under `ajv-formats`; the override removes
that still-vulnerable copy too.
- Regenerates `test/doi/bun.lock` with the repository-pinned Bun 1.3.10.

These are development-only dependencies of `test/doi`; this patch does
not change the shipped frontend or main application bundle.

## Validation

- `bun install --frozen-lockfile` — pass.
- `bun run test` — 15 pass, 0 fail (121 assertions).
- `bun audit --json` — `{}`; no advisories in the installed DOI-test
dependency tree.

The planned KYAML corpus migration is intentionally separate. This patch
is independently reviewable and cherry-pickable; the migration requires
the repository's pinned Julia-based converter and its equivalence/gate
checks.

Co-authored-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: 3 people

test/doi/bun.lock

@@ -9,8 +9,11 @@
   },
   "devDependencies": {
     "@playwright/test": "1.63.0",
-    "ajv": "8.17.1",
+    "ajv": "8.18.0",
     "ajv-formats": "3.0.1",
-    "yaml": "2.8.2"
+    "yaml": "2.8.3"
+  },
+  "overrides": {
+    "ajv": "8.18.0"
   }
 }