security: remediate ASVS 5.0 audit findings (input validation + supply-chain hardening)

[spencer-osbrjp]

Remediation of the ASVS 5.0 audit (report: asvs-audit-5.0-2026-07-23.md). The audit found 4/7 chapters clean at all levels; L1 is blocked by two chapters. This closes the actionable code gaps, the outstanding verification, and the security-documentation gaps.

Code fixes

• T-2-1 (V2 2.2.1, L1 — the one genuine code gap): validate the free-form project name / destination directory. create ../../foo or /etc/foo currently writes outside cwd, and the name is emitted as package.json name with no npm-name check. Add a shared ValidateProjectName (stdlib filepath.IsLocal + ^[a-z0-9][a-z0-9._-]*$, len ≤214), wired into the CLI arg path, the . path, and the TUI confirm step.
• T-15-3 (V15 15.3.2, L2): disable redirect-following on the npm-registry HTTP client (cmd/bump.go) via CheckRedirect.
• T-15-4 (V15 15.2.3, L2): gate the maintainer-only bump command behind a //go:build bump tag so it is not compiled into the released binary; CI runs it with -tags bump.

Verification

• T-15-1 (V15 15.2.1, L1): run govulncheck ./..., remediate anything found, add a govulncheck step to run-tests.yml.

Documentation

• T-15-2 / T-15-5 / T-15-6: add SECURITY.md — Go-dependency update & remediation policy, a "dangerous functionality" section (subprocess exec + npm fetch and their safeguards), and a risky-components note; add .github/dependabot.yml for the gomod ecosystem.
• T-13-1: document the tool's sole outbound dependency (registry.npmjs.org, bump-only, 20s timeout, no retries) in CLAUDE.md/SECURITY.md.
• T-2-2: document the project-name/dest-dir validation rule (matching T-2-1).

Out of scope here

• T-13-2 (SLACK_WEBHOOK_URL rotation) — requires GitHub org secret-console access, not a code change; tracked separately.

All fixes keep the tool's existing behavior for valid inputs; each is covered by the existing go test ./... plus a new table test for the validator.