fix: prerm stop-before-rt_tables, BusyBox awk, js-yaml vuln

- service/package.uc: call INIT_PATH stop before process-killing in
  prerm_cleanup so the routing table entry is still visible when the
  service shuts down (fixes test: 'prerm must stop Tachyon before
  removing its routing table name')
- service/package.uc: replace awk regex with | alternation and \/
  escaping with grep -E / grep -F; BusyBox awk does not support |
  in regex literals and silently mishandles \/ — fixes awk syntax
  errors in CI (both prerm_cleanup and postinst_restore)
- fe-app-tachyon: pin js-yaml to ^5.2.1 via overrides to fix the
  quadratic O(n^2) !!omap resolution DoS (same root cause as
  CVE-2026-59870 / GHSA-724g-mxrg-4qvm, never backported to 3.x/4.x)
- fe-app-tachyon: npm audit fix for brace-expansion and nanoid vulns

fe-app-tachyon/package.json

@@ -1,4 +1,4 @@
-{
+{
   "name": "fe-app-tachyon",
   "version": "1.2.47",
   "license": "MIT",
@@ -37,6 +37,7 @@
     "vitest": "^4.1.10"
   },
   "overrides": {
-    "postcss": "8.5.23"
+    "postcss": "8.5.23",
+    "js-yaml": "^5.2.1"
   }
 }