fix(deps): transitive nanoid, and a pre-push gate that asks the registry directly

[important-new]

Two commits: the advisory itself, and the gate that found it.

The advisory

nanoid <3.3.17 (high, GHSA-2v37-7h3g-55p8), reached via vite -> postcss.
Published 2026-07-29 and still unflagged by Dependabot on this repository ten
days later.

npm update rather than an override, deliberately: this repo also carries a
direct nanoid@5.1.16, and a blanket "nanoid" override would drag that one
down to the v3 line. postcss's range is a caret, so the transitive copy moves on
its own. Lockfile touched in place; linux entries 346 -> 346.

Why a gate, given Dependabot exists

Dependabot is a server-side scan, and its scan lags the advisory. Measured
against this project's own alerts:

	advisory published	alert created	lag
dompurify	2026-08-07 15:30Z	08-08 00:01Z	8.5 hours
nanoid	2026-07-29 15:31Z	08-08 00:18Z	10 days

So a release reading "Dependabot: 0 open" is reading "GitHub has not looked
yet". Asked directly the same day, npm audit reported a HIGH advisory in two
of three sibling repositories while both showed zero open alerts.

scripts/check-advisories.mjs runs at pre-push and is not gated on
package-lock.json moving — an advisory is published against code already
sitting in the lockfile, so "nothing changed" is exactly the case it must catch.

It is built to fail rather than pass when it cannot see

• A transport error, a timeout, or an endpoint that does not implement audit is a
  failure, never a clean result.
• The report must account for a non-zero dependency count: an audit that
  examined nothing and an audit that found nothing produce the same emptiness.
• The registry is pinned to registry.npmjs.org. Not decoration — the machine
  this was written on resolves to a mirror that answers /-/npm/v1/security/*
  with [NOT_IMPLEMENTED], so an unpinned audit checks nothing and looks clean.

Proven both directions before wiring: RED on the pre-fix lockfile (naming package,
range, advisory URL, transitive), GREEN on the fixed one reporting
1013 dependencies checked, RED against the mirror.

⚠️ The first version went red for the wrong reason — spawning npm.cmd
without a shell is EINVAL on Windows. Red for the wrong reason is no better than
green for the wrong reason; the registry argument is URL-validated now because it
reaches a shell.

SKIP_ADVISORY_AUDIT=1 exists for a genuine outage and announces itself.
Manual run: npm run lint:advisories.

Full suite green locally: lint (24 gates), test:unit 723/5236, test:web 335/2232.

🤖 Generated with Claude Code