Allowlist the dev-only minimatch advisory (no compatible typedoc fix) #362

Context

The Dependency audit CI job (the repo's pnpm audit policy) fails on main with a moderate advisory in minimatch (GHSA-g3hv-75wg-m249, globparts DoS, vulnerable >=7.0.0 <11.0.1, fixed 11.0.1). It is a dev-only transitive dependency reached through eslint and typedoc (.>@eslint/js>eslint>minimatch, ~46 paths); the published package has zero runtime dependencies, so it never ships.

It has no compatible fix: forcing minimatch to 11.0.1 breaks typedoc, which calls minimatch's removed private matchOne API. The latest stable typedoc (0.28.20) declares minimatch ^10.2.5; there is no typedoc release that supports minimatch 11 (next is 1.0.0-dev prereleases), and patching typedoc breaks the audit tooling (it reconstructs a minimal file set and cannot resolve patches).

So this is a dev-only advisory with no compatible fix — the appropriate action is an explicit, expiring risk acceptance via the repo's own allowlist (.github/audit-allowlist.txt), not a version bump.

Acceptance criteria

• .github/audit-allowlist.txt on main contains one valid entry for GHSA-g3hv-75wg-m249 (format: GHSA-... expires=YYYY-MM-DD approver=@handle reason="...").
• The Dependency audit job passes on main.
• No dependency or lockfile change (allowlist only).

Scope / out of scope

In scope: the single allowlist entry.
Out of scope: bumping minimatch/typedoc (no compatible combination exists) and the 15 dev-tooling Dependabot alerts (handled in #360/#361).

Notes

• The allowlist is read from the base (main) checkout by the trusted audit policy, so this must land on main; PR Bump dev-tooling dependencies to clear 15 Dependabot advisories #361 then goes green once rebased.
• Re-check before the expiry: a future typedoc that supports minimatch 11 would let us drop this entry.