Patch two high-severity advisories in dev dependencies

Both are transitive, lockfile-only, and within the ranges their parents
already declare, so no direct dependency moves.

- fast-uri 3.1.4 -> 3.1.5 (CVE-2026-18446, GHSA-7p8r-x3mc-p8w7): host
  confusion via a backslash authority introducer. Reaches the tree through
  ajv, which declares ^3.0.1. This is Dependabot alert #90, open since
  2026-08-04.
- brace-expansion 5.0.8 -> 5.0.9 (GHSA-rgw5-rvv9-x895): DoS via unbounded
  intermediate arrays, bypassing the CVE-2026-14257 mitigation. Reaches the
  tree through eslint -> minimatch. Not reported by Dependabot.

`npm audit` now reports 0 vulnerabilities. Verified the consumers of both
packages still work: `eslint schema/` is clean and
`tsx scripts/validate-examples.ts` passes 258/258.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>