Bump Snyk-flagged dependencies

[bruce-y]

Consolidates 5 open Snyk upgrade PRs (#16, #17, #18, #19, #20) into a single PR by bumping the minimum versions in package.json.

How it works:

• @actions/core ^1.10.1 → ^1.11.1
• @actions/github ^6.0.0 → ^6.0.1
• @actions/tool-cache ^2.0.1 → ^2.0.2
• @vercel/ncc ^0.38.0 → ^0.38.3
• yaml ^2.2.1 → ^2.8.0

The three @actions/cache Snyk PRs (#15, #21, #23) were intentionally excluded — they would replace the @useblacksmith/cache fork with the official @actions/cache, breaking the Blacksmith integration. The lockfile and dist/ will be regenerated in CI once the BUF_TOKEN is available for the private registry.

---

View Codesmith session

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}