Refresh qs transitive security patch

[ty-everett]

Summary

• refresh the Stryker-only typed-rest-client transitive dependency from vulnerable qs@6.15.1 to patched qs@6.15.3
• remove the now-unused vulnerable lockfile snapshot
• keep the change lockfile-only: no override, manifest, source, package version, published artifact, or runtime dependency change

Security context

GitHub alert #1414 / GHSA-q8mj-m7cp-5q26 was disclosed while PR #369 was merging. The automatic Dependabot job initially failed because it saw 6.15.2 as the first fixed version before that release was available. npm now provides 6.15.3. qs is reachable only through @stryker-mutator/core@9.6.1 -> typed-rest-client@2.3.1, so this is a development-only mutation-testing dependency.

Validation

• frozen install
• pnpm why qs: one version, 6.15.3, only through Stryker
• pnpm audit --audit-level=moderate: zero known vulnerabilities
• pnpm audit:security: zero known vulnerabilities
• pnpm health:check: 43/43 and 0 repository-health findings/control errors
• pnpm test:governance: 25 property suites mapped to 25 mutation targets
• pnpm test:mutation --target paymail-address: 92.16%, 0 uncovered, 0 invalid

Advances #324 and closes the newly opened dependency alert without suppressing it.

[ty-everett]

Admin exact-head review completed by ty-everett at c389a49721f61d3e4720aa4ad6359c89e9f9b576. The single lockfile delta removes vulnerable qs@6.15.1, resolves Stryker’s development-only typed-rest-client edge to patched qs@6.15.3, and introduces no override, manifest, runtime, source, package-version, or publication change. Frozen install, moderate audit, high/critical audit, repository health, test governance, and a live Stryker target all pass locally. GitHub does not permit an author to submit APPROVED on their own PR; admin merge will be used only after all automated checks and review threads are green.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!