chore: replace npm-run-all with npm-run-all2

npm-run-all has been unmaintained for 7+ years and pulls in a vulnerable
version of minimatch. npm-run-all2 is a drop-in maintained fork that
replaces minimatch with picomatch, eliminating the vulnerability.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mattgodbolt