Resolve qs security advisories in the documentation dependency graph

[rmcdaniel]

Summary

Select qs 6.16.0 through the existing npm override mechanism and update only its lockfile entry. Express and body-parser constrain their transitive dependency to ~6.15.1, so a lockfile-only update cannot select the patched minor release.

Addresses GHSA-4mjr-xmp4-gh2g and GHSA-x5fp-wj9c-mxmx. The published site is static; this fixes the build/development dependency graph rather than claiming a production application compromise.

Validation

• Node 24 clean install passed (lifecycle scripts disabled for the focused local dependency check; ordinary CI ran npm ci with scripts).
• The installed patched version, hostile constructor round-trip, and ordinary query parsing passed.
• npm audit no longer reports qs or moderate findings. It still exits 1 for the previously documented image-size advisories and their Docusaurus dependency effects (18 high dependency entries, no upstream fix reported); this is not a zero-vulnerability audit claim.
• Reviewed the two-file dependency diff; git diff --check passes.
• Full public CI build and link validation passed, along with the protocol catalog and boundary checks.

No documentation prose, pipeline, or new guardrail scripts are changed.

[rmcdaniel]

Merged and deployed from f34e7ea. The GitHub Pages deployment completed successfully: https://github.com/durable-workflow/durable-workflow.github.io/actions/runs/33959019724 . Dependabot alerts 132 and 133 both report fixed at 2026-09-05 09:49:33 UTC. The organization open-alert inventory is empty; the previously recorded image-size exceptions remain separate from this fix.