fix(ci): synchronize npm lockfile

[mylukin]

Summary

• add the missing optional @emnapi lockfile entries so npm ci succeeds
• update js-yaml and undici within their existing semver ranges to clear the production audit
• rebind seven proven helper-state false positives in the silent-column-drop baseline and remove two resolved entries
• replace three vague publish diagnostic fallbacks with concrete states
• keep the existing cross-platform and scheduled coverage unchanged

Validation

• CI=true npx --yes npm@10.9.8 ci --ignore-scripts --no-audit --no-fund
• CI=true npx --yes npm@10.9.8 audit --omit=dev --audit-level=high
• CI=true npm run check:silent-column-drop
• CI=true npm run check:typed-error-lint
• CI=true npm run build
• both Vitest unit/extension shards: 1,327 passed, 1 skipped
• focused Xiaohongshu/YouTube publish tests: 47 passed
• git diff --check