* chore(deps): resolve all Dependabot security alerts (dev deps)

Resolve all 6 open Dependabot alerts, all in development scope:

- uuid ^10.0.0 -> ^11.1.1 (devDependency) — missing buffer bounds
  check in v3/v5/v6 (#46, #45)
- fast-uri 3.0.6 -> 3.1.2 via resolutions — host confusion and path
  traversal via percent-encoded sequences (#42, #41)
- picomatch 2.3.1 -> 2.3.2 via resolutions — method injection in
  POSIX character classes (#36)
- @tootallnate/once 2.0.0 -> 2.0.1 via resolutions — incorrect
  control flow scoping (#43)

Transitive deps are pinned via the existing `resolutions` block since
Yarn 1's `upgrade` doesn't bump transitive-only packages. All changes
are dev-scoped; `yarn build` and the full test suite (363 tests) pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(deps): remove unused uuid and @types/uuid devDependencies

Both were only ever used by the examples/ directory, which was deleted
in #149 (commit 4b7760c, 2025-08-04), leaving them orphaned and unused
for ~10 months. The current tree has zero imports of uuid.

Removing them drops two packages from the dependency tree (and their
future Dependabot alerts) and supersedes the uuid 10->11 bump as the
fix for the uuid buffer-bounds alerts (#45/#46). The fast-uri, picomatch,
and @tootallnate/once resolutions are unaffected (pulled via jest/
webpack/msw, not uuid). yarn build and the full test suite (363) pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>