chore: migrate from yarn/mocha to npm/vitest

[eablack]

Summary

Resolves all 22 yarn audit vulnerabilities by replacing the mocha + nyc + chai + ts-node test toolchain with vitest, and switches the package manager from yarn to npm. 21 of the 22 advisories were transitive deps of the old test toolchain (brace-expansion, serialize-javascript, diff); the last one (node-notifier > uuid@8.3.2) is cleared with a single uuid: ^11.1.1 override.

Test framework migration

• Replace mocha, nyc, chai, ts-node, @types/mocha, @types/chai, eslint-plugin-mocha with vitest + @vitest/coverage-v8
• Update lone test file to import describe/it from vitest
• Delete test/helpers/init.js and test/tsconfig.json (mocha-specific)
• Drop the mocha config block from package.json and the mocha/no-mocha-arrows rule from eslint config

Package manager migration

• Replace yarn.lock with package-lock.json and un-ignore it in .gitignore
• Convert resolutions → overrides in package.json
• Switch CI workflow to cache: npm / npm ci / npm test / npm run lint
• Switch reusable release workflows to package-manager: npm

Also includes in-flight changes from the update-release-configs.yml workflow that were already present in the working tree (formatting in dependabot.yml, expanded changelog-sections in release-please configs).

Type of Change

• chore: Change that does not affect production code

Testing

Steps:

1. Passing CI suffices.
2. Locally: npm ci && npm test && npm audit — all green, 0 vulnerabilities.

Related Issues

GitHub issue: N/A
GUS work item: N/A

[michaelmalave]

LGTM!