Security: classify and gate npm audit findings reported by CI

[ruvnet]

Finding

The CI run for PR #42 completed successfully, but npm ci reported 8 dependency vulnerabilities: 2 low, 3 moderate, 1 high, and 2 critical across the installed workspace dependency graph. The current CI workflow does not fail on that output.

This issue does not claim that the critical findings are exploitable in production. They may be dev-only, transitive, optional, or unreachable. The security gap is that severity and reachability are not being classified or enforced before a green CI conclusion.

Required review

1. Capture npm audit --json for the exact lockfile and Node/npm versions used by CI.
2. Separate production, development, and optional dependency findings.
3. Record direct package, transitive path, advisory, vulnerable range, installed version, fixed version, and whether the vulnerable code is reachable from published runtime entrypoints.
4. Test npm audit --omit=dev and the actual packed/published dependency set.
5. Prefer minimal non-breaking upgrades. Do not run npm audit fix --force without review.
6. Where no safe upgrade exists, document compensating controls and an explicit expiry date.

CI policy proposal

Add a dependency-security job that fails on reachable high or critical production vulnerabilities. Report but do not automatically fail on dev-only findings until they are classified. Keep optional dependency isolation tests because the workspace intentionally supports graceful RuVector degradation.

Acceptance

Every current high and critical finding is either removed, demonstrated not to ship or be reachable in production, or covered by a time-bounded exception with rationale. CI then enforces the agreed production threshold. Do not weaken tests or remove functionality merely to suppress audit output.