fix(deps): remove vulnerable docs tooling

Replace CLI2's unpatched braces dependency with markdownlint-cli.

Preserve link checks and CHANGELOG rules; pin patched release and parser dependencies.

package.json

@@ -6,7 +6,7 @@
     "node": "24.21.0"
   },
   "scripts": {
-    "lint": "markdownlint-cli2 \"**/*.md\" \"#node_modules\"",
+    "lint": "markdownlint --dot --rules .markdownlint-rule-relative-links.cjs --ignore node_modules --ignore CHANGELOG.md -- \"**/*.md\" && markdownlint --config .markdownlint-changelog.json --rules .markdownlint-rule-relative-links.cjs -- CHANGELOG.md",
     "verify": "npm run lint && git diff --check",
     "release:preview": "release-it --dry-run --ci",
     "release:prepare": "release-it --ci",
@@ -17,13 +17,18 @@
     "@commitlint/config-conventional": "21.2.2",
     "@release-it/conventional-changelog": "12.0.0",
     "conventional-changelog-conventionalcommits": "10.4.0",
-    "markdownlint-cli2": "0.23.2",
-    "markdownlint-rule-relative-links": "5.1.2",
+    "markdownlint-cli": "0.49.1",
+    "markdownlint-rule-relative-links": "5.1.3",
     "release-it": "21.0.2"
   },
   "overrides": {
-    "markdownlint-cli2@0.23.2": {
+    "markdownlint-cli@0.49.1": {
+      "js-yaml": "5.4.2",
       "smol-toml": "1.8.0"
+    },
+    "release-it": {
+      "basic-ftp": "6.2.1",
+      "undici": "7.29.1"
     }
   }
 }