fix(deps): the js-yaml override follows the direct dependency
The root Dependabot job failed with the message that the override for js-yaml 5.4.2 conflicts with the direct dependency whenever it tried to bump js-yaml, because the override in package.json carried its own range. The overrides and the pnpm.overrides now reference the direct dependency, so a bump of js-yaml changes one field and the override follows it. The lockfile is unchanged (js-yaml 4.3.2 for the root and for markdownlint-cli): npm install with package-lock-only reported up to date and 0 vulnerabilities, and a bun install dry run in a scratch copy resolved the tree with the reference.
Summary by cubic
Fixes the root Dependabot job failing when bumping js-yaml, because the override carried its own range that conflicted with the direct dependency. The overrides and pnpm.overrides now reference the direct dependency ($js-yaml), so a bump changes one field and the override follows it. The nested markdownlint-cli>js-yaml selector was dropped since the bare override already resolves to the same spec. The lockfile is unchanged (js-yaml 4.3.2 for both the root and markdownlint-cli).