Release 0.7.1 security fixes

[mickmicksh]

Summary

• prevent registry-controlled OS command injection during lapsh login
• validate registry and authentication URLs in the Python and TypeScript CLIs
• remove reporter-controlled URL fetching from privileged issue automation
• harden GitHub Actions and update the vulnerable js-yaml dependency
• bump npm and PyPI packages to 0.7.1

Root cause

The TypeScript login flow interpolated a registry-provided authentication URL into a shell command. Registry URL validation also relied on unsafe prefix checks that could be bypassed with URL credentials.

Validation

• TypeScript npm test: passed
• Python CI suite: 1,057 passed, 22 skipped
• npm audit: 0 vulnerabilities
• npm pack --dry-run: valid @lap-platform/lapsh@0.7.1 tarball