fix: remove vulnerable glob runtime graph

[rogerchappel]

Summary

• Upgrade the shipped glob dependency from 10.5.0 to 13.0.6 and pin transitive consumers to the supported runtime version.
• Refresh the lockfile to resolve brace-expansion 5.0.7, removing GHSA-3jxr-9vmj-r5cp from the production graph.
• Preserve default exclusions, custom patterns, and existing ignore behavior with focused analyzer coverage.
• Add npm run audit:prod to release:check, which is already the CI gate, and document it.

Baseline evidence on origin/main (0ec4945): npm ci warned that glob@10.5.0 is deprecated, and npm audit --omit=dev --json reported one high-severity production vulnerability in brace-expansion with two affected nodes.

Commits

• 04d1f3f test: lock file discovery behavior
• 578f940 fix: update runtime glob dependency
• a125e08 ci: audit production dependencies in release checks
• a910a1e docs: document the production audit gate

Verification

• Tests or checks run:
  • npm ci (no deprecated/unsupported glob warning)
  • npm audit --omit=dev --json (0 production vulnerabilities)
  • npm run release:check (71 tests passed; typecheck, lint, coverage, smoke, and package smoke passed)
  • npm run validate
  • npm pack --dry-run (27 expected packed files)
  • git diff --check
• Manual review completed: confirmed no overlapping open issue or PR before implementation and again before push; reviewed the final four-file diff and tarball manifest.

Risk Level

• Low
• Medium
• High

Notes: glob is a runtime major-version update. Its documented Node engine remains compatible with this package's Node 18 minimum, and discovery behavior is covered by targeted and full-suite tests.

Rollback Plan

• Revert these four commits to restore the previous dependency graph and release gate. No data or schema migration is involved.

Human Decision Needed

• None
• Maintainer review
• Product/design decision
• Security/privacy review
• Other: