ACT-3680: remediate linkify-it vulnerabilities

[robertvangor]

Summary

• update the transitive documentation toolchain from markdown-it 14.1.1 to 14.3.0
• resolve linkify-it to 5.0.2, fixing GHSA-22p9-wv53-3rq4 and GHSA-v245-v573-v5vm
• remove the related markdown-it moderate finding, GHSA-6v5v-wf23-fmfq
• supersede build(deps-dev): bump markdown-it from 14.1.1 to 14.2.0 #106: its 14.2.0 lockfile update resolves only linkify-it 5.0.1, which remains affected by GHSA-v245-v573-v5vm

Scope

This is development-only documentation tooling (jsdoc-to-markdown → jsdoc → markdown-it); no SDK runtime source changes are included.

Validation

• Node 20, 22, and 24: npm ci, build, lint, and 158 Jest tests
• Node 20 and 24: coverage (99.39% lines)
• bounded linkify-it / markdown-it parser smoke
• packed SDK clean-consumer install and import
• composed locally with ACT-3680: remediate brace-expansion vulnerabilities #115: clean merge, exact-head ancestry, zero-vulnerability npm audit, and byte-identical packed public artifacts