fix(deps): clear development-tooling audit findings

[rogerchappel]

Summary

• update Vitest and its coverage companion to compatible patched 3.2.7 releases
• refresh transitive Vite, esbuild, PostCSS, js-yaml, and brace-expansion resolutions so the complete lockfile audit is clean
• add audit:all to the release gate while retaining the production-only audit
• document the complete dependency and release-readiness checks for maintainers

Commits

• 226c6c2 fix(deps): update audited development toolchain
• 9a754fc docs: document the complete dependency audit gate

Verification

Executed the following full gate under each documented CI runtime (Node 20.19.0, 22.23.1, and 24.18.0):

npm ci
npm run release:check

Each matrix entry reported:

• 0 vulnerabilities from npm audit
• 0 vulnerabilities from npm audit --omit=dev
• 72 tests passed with V8 coverage
• CLI smoke passed
• packed-package install and CLI smoke passed (27 packed files)

Additional checks:

npm audit --json --package-lock-only
git diff --check origin/main..HEAD
git log --format='%h%x09%an%x09%ae%x09%cn%x09%ce' origin/main..HEAD