[thomashoneyman]

Dependency security fixes

• Update markdown-it to ^14.3.2 and tar to ^7.5.22; update locked brace-expansion to 5.0.12.
• Remove micromatch and its unpatched braces dependency. The only call used micromatch.matcher, which delegates to picomatch; use the existing picomatch dependency directly.
• npm audit reports zero vulnerabilities, down from five affected packages.

CI compiler upgrade

The initial macOS run passed 250/251 tests; the remaining bundle test failed when purs 0.15.15 exited with SIGSEGV. Linux and Windows were cancelled by matrix fail-fast.

Update build and release workflows to PureScript 0.15.16. Upstream purescript/purescript#4570 reports intermittent macOS worker-thread crashes on 0.15.15 and no crashes in a matching 25-build trial on 0.15.16. This supports the upgrade but does not establish the exact cause of our crash.

Keep default compiler parallelism and matrix fail-fast. An initial GHCRTS=-N1 precaution has been removed because its necessity was not established. No retries, disabled assertions, or timeout increases.

Verification

• Local: npm ci/audit, 551 matcher assertions, archive/Markdown/globbing smoke checks, build on 0.15.16, and 5/5 bundle tests passed.
• Workflow YAML validation confirms 0.15.16, default compiler parallelism, and unchanged matrix fail-fast.
• The previous run with GHCRTS=-N1 passed all three platforms and both Nix checks: https://github.com/purescript/spago/actions/runs/37971942017
• Latest CI with default compiler parallelism passed all five checks: https://github.com/purescript/spago/actions/runs/37975030694
• Spago tests: Linux and macOS 251/251 each; Windows 252/252. Docs-search tests: 70/70 on each platform. Formatting passed. Both Nix checks passed.
• Test-step timings (previous -N1 run → default threads, both on 0.15.16): Linux 4m22s → 7m02s; macOS 9m51s → 11m09s; Windows 13m05s → 12m37s. These single-run measurements include runner/cache variation and are not a controlled benchmark.

Limitations

• One green run cannot prove intermittent crashes/timeouts are eliminated.
• The full local suite was killed by the sandbox before completion.
• The Dependabot alerts API denied access, so private alerts were not verified.