Resolve Dependabot security-update deadlock caused by transitive undici@5.x - #44

Dependabot was failing with security_update_not_possible because the lockfile still resolved a legacy @semantic-release/npm@13.1.1 path that pinned @actions/http-client@2.x and therefore undici@5.29.0 (below the minimum fixed line).

• Root-cause correction

  • Added a Yarn resolution to force @semantic-release/npm onto ^13.1.5, eliminating the stale transitive branch that required @actions/core@1.x.

• Dependency graph cleanup (lockfile)

  • Regenerated yarn.lock so the graph no longer includes:
    • @semantic-release/npm@13.1.1
    • @actions/http-client@2.2.3
    • undici@5.29.0
  • Resulting graph resolves undici only via 6.x paths.

• Implementation snippet

  {
    "resolutions": {
      "@semantic-release/npm": "^13.1.5",
      "lodash": "^4.18.0"
    }
  }