chore(deps): major bumps — marked 18, ejs 6, js-yaml 5, @vscode/vsce 3.7.2-13

Landed the buddy-bot major dependency PRs onto current main (they were
generated against a stale base and conflicted / would have reverted workspace
versions, so applied the dep bumps directly and regenerated the lockfile).
All four live in non-core packages (benchmarks, vscode) — stx core untouched.

Closes #1665
Closes #1724
Closes #1762
Closes #1663

Author: glennmichael123