(deps): port upstream js-yaml and postinstall security fixes #817

Port two upstream security fixes.

• 7c31de0 (fix: upgrade js-yaml to patched version (GHSA-5p4m-2wfm-xmqj) doctly/switchboard#101, Anupam Mediratta): js-yaml 4.1.1 → ≥4.3.2 (GHSA-5p4m-2wfm-xmqj). The lock still pins 4.1.1, pulled in by electron-updater (parses latest.yml). Regenerate with npm update js-yaml; do not paste the upstream hunk.
• 63e30df (fix: avoid shell interpolation in postinstall codesign doctly/switchboard#87, Anupam Mediratta): scripts/postinstall.js runs execSync(`codesign … "${file}"`); switch to execFileSync with an argv. Keep the fork's scrubSessionEnv(process.env), moved under the require.main === module guard so requiring the module in tests does not mutate the environment.

Tests: upstream's postinstall test with a stubbed signer (spaces, quotes, backslashes in file names); win32 skips as upstream.