chore(audit): execute 2026-06-11 audit — docs GFM tables fix + guardrails (3 findings, 2 refuted)

[agjs]

Summary

Executes the 2026-06-11 monorepo audit. Of the report's 5 findings, 3 were real and fixed; 2 were false findings (verified and skipped, not patched), plus 4 carried-over blocked items refuted.

• F001 (high, docs): GFM was never wired into the Starlight MDX pipeline, so every pipe table across the docs site (14 pages incl. /skills/spec-loop/, auth-contract, env-vars, …) shipped as literal | … | text instead of <table>. Wired remark-gfm into markdown.remarkPlugins, pinned it as a direct dep, and added a post-build check:rendered-markdown guard (in build:ci) that fails if any rendered page contains unrendered table-delimiter residue — proven to flag all 14 pages when GFM is removed and to ignore intentional table syntax inside fenced code blocks.
• F003 (med, api): engine-pin-parity only checked a nonexistent apps/api/.github/workflows/ci.yml, leaving all root workflows' bun-version pins unvalidated against engines.bun. Extended it to scan every root workflow and every bun-version: occurrence; added a multi-workflow test. Proven: injecting a drifted pin now fails lint:meta.
• F005 (low, ui): Playwright PORT was hardcoded to 7331; now overridable via PLAYWRIGHT_PORT (propagates to baseURL and the webServer readiness URL).

Skipped as false findings (verified, not patched)

• F002: infra-compose-security-secrets.yml already gates the expensive gitleaks steps via an in-job dorny/paths-filter. The unfiltered pull_request trigger is the repo's documented intended pattern (see lint-meta github-actions-paths-filter-parity: "PR triggers stay unfiltered so branch protection always gets a status"). Adding a PR paths filter would remove the stable required-status guarantee.
• F004: Committed og-image.png (56,705 bytes) is reproduced byte-for-byte by generate:og-image. The audit's claimed 100KB HEAD blob was wrong. No drift.

Also refuted: gitleaks "missing pipefail" (set -euo pipefail already present), Trivy SARIF continue-on-error (GitHub-recommended if: always() pattern; scan still gates via exit-code: 1), and the security-workflow cancel-in-progress item (intentional, enforced by github-actions-security-no-cancel).

Test plan

• bun run check — api ✅ and ui ✅ green
• cd apps/docs && bun run build:ci ✅ (build + fragments + new check:rendered-markdown + linkcheck all pass via pre-push)
• Pre-push full security/smoke + linkcheck gate passed on push
• engine-pin-parity tests: 6 pass (5 original + 1 new multi-workflow)

App merge bars

Area	Command
API	cd apps/api && bun run validate
UI	cd apps/ui && bun run validate
Docs	cd apps/docs && bun run build:ci
Repo drift	bun run check (from repo root)

Conventions

• No any, no blind as, no !
• New env vars in schema + .env.example (+ SECURITY.md when relevant) — n/a (PLAYWRIGHT_PORT is a local test-runner override, not an app env var)
• Tests updated for changed behavior (engine-pin-parity multi-workflow test)

Screenshots

Tables now render as real <table> elements site-wide (e.g. /skills/spec-loop/) instead of literal pipe text. No app-UI change.