[security] Security policy: production dependency audit is advisory-only in CI merge path

[ddarkr]

Problem

The CI workflow runs pnpm audit:prod, but the dependency audit step is configured as advisory-only in CI. If the project policy is "production dependency vulnerabilities must not merge to trunk," the CI merge path should fail on newly introduced production dependency vulnerabilities, rather than warning only.

Evidence

• CI reports dependency audit findings but does not fail the merge path.
• Publishing is protected later by the release workflow, but this occurs later than PR/trunk merge validation.
• Vulnerable production dependencies can potentially reach trunk before being blocked at publish time.

Desired outcome

The security policy regarding dependency audits in the CI merge path is clearly defined, documented, and enforced consistently in the workflows.

Acceptance criteria

• Security policy is explicit.
• Maintainers know whether dependency audit is a merge blocker or publish blocker only.
• CI summary wording matches the actual policy.