deps: bump fast-uri from 3.1.6 to 3.1.7 (GHSA-58mr-gqgx-xq4g, GHSA-qw65-cvwx-89v3)

[katsugtgz]

Updates fast-uri to address GHSA-58mr-gqgx-xq4g and GHSA-qw65-cvwx-89v3.

Evidence:

• bun.lock resolved fast-uri@3.1.6 (transitive via ajv)
• the two advisories (host confusion via unclosed bracket, authority injection via unvalidated port, both high) apply to 3.1.6
• updated version: 3.1.7 (OSV reports no advisories against 3.1.7)

Validation:

• bun install --frozen-lockfile passes
• bun run release:check passes (includes lint, typecheck, build, unit tests: 1324 pass, 0 fail, and the package smoke test)

Scope: lockfile update only.

[devin-ai-integration]

E2E review: BLOCKED, waiting for maintainer approval to run code

Head: 8775fae03c6e9eadca109d6f67ddcdbcc1e8f882 · Base: cd39e173e72c8aaa344f3e72d6a19bff59595e2d

This PR comes from a fork (katsugtgz/betterwright, author association NONE). Automation policy is not to run fork code until a repository maintainer explicitly approves it. I found no such approval, so I did not install, build, test or record anything. There are no videos.

Static checks only (not E2E proof):

• Diff: one line in bun.lock, fast-uri 3.1.6 → 3.1.7. No source or manifest changes.
• The lockfile integrity hash sha512-dOvZVzjd…VzjVVHg== matches the npm registry's dist.integrity for fast-uri@3.1.7.

Journey	Outcome
bun install --frozen-lockfile, lint, typecheck, build, unit tests	blocked (fork, not approved)
CLI / SDK / MCP / browser flows that use ajv (via fast-uri)	blocked
MP4 recordings	blocked (nothing was run)

Confirmed findings: none. Fix PRs: none.

To unblock: a maintainer can comment explicit approval to run this PR's code, and the review will be re-run for this SHA.

[devin-ai-integration]

I didn't run anything for #229 (8775fae): it's a fork PR from a first-time contributor, and no maintainer has approved running its code, so there are no tests or videos. I only checked it statically: the single bun.lock line (fast-uri 3.1.6 → 3.1.7) has an integrity hash that matches the npm registry. I posted a blocked report on the PR: #229 (comment)