remove unused fs placeholder dependency

[dmartin-figma]

Description

ci-queue declared fs@^0.0.1-security as a runtime dependency. fs is a Node.js built-in core module — the import { writeFileSync } from 'fs' / from 'node:fs' calls in javascript/src always resolve to the core module, never to an npm package. The npm fs package at 0.0.1-security is npm's empty security placeholder (no code, no install scripts, no dependencies) published to neutralize the squatted name. It is harmless but completely unused, so this removes it from package.json and package-lock.json.

This dependency also propagates into consumers (it currently shows up in figma/figma's pnpm-lock.yaml via the ci-queue dependency), so removing it here drops the noise downstream once the ci-queue pin is bumped.

No behavior change — fs imports continue to resolve to the Node core module.

Test Plan

• npm install regenerates the lockfile cleanly with no fs entry
• npm run build (tsc) succeeds — fs/node:fs imports compile against the Node built-in
• npm test results unchanged vs. master (pre-existing, unrelated test-suite failures present on master before this change)