[benjaminkott]

Description

Build/package.json listed audit and fix as dependencies. Nothing
in the build requires them; they only pulled a stale underscore into
the tree. Both go, and the lock file loses them with their transitive
packages.

Type of change

• Bugfix
• Task
• Feature
• Documentation

Related issues

Fixes #1631

How to validate

1. npm --prefix Build ci && npm --prefix Build run build
2. The build passes and leaves the working tree clean.

AI assistance

• Agent and version: Claude Code, VS Code extension
• Model and effort/reasoning level: Claude Opus 5.5, low effort
• Share written by the agent: the whole change and this description
• Reviewed and understood before pushing: summary reviewed and push
  approved by the maintainer

Checklist

• Targets master
• Commits are signed off (git commit -s)
• Commit subjects follow [BUGFIX|TASK|FEATURE] Subject
• composer cgl leaves the code unchanged — no PHP changed
• composer phpstan passes — no PHP changed
• composer test passes — no PHP changed
• A bugfix comes with a test that fails without it — not a bugfix
• Holds on every TYPO3 and PHP version declared in composer.json
• Assets rebuilt — full build in ddev, output unchanged
• Documentation updated — not user facing