Replace or isolate the legacy Shortcut compiler dependency

[vladimirperovic]

Problem

The legacy Siri Shortcuts module depends on scpl-macos-updated, which currently pulls the obsolete uuid@3 line. The current npm advisory affects UUID v3/v5/v6 calls with caller-provided buffers. Keryx does not directly call those APIs, and the remaining advisory is moderate rather than high, but the dependency is old and has no compatible upstream fix available through npm audit fix.

Goal

Remove the obsolete transitive dependency without breaking .shortcut generation.

Options to evaluate

1. Replace scpl-macos-updated with a maintained compiler/library.
2. Vendor and audit the minimal compiler code required by Keryx, if license and maintenance cost are acceptable.
3. Move Shortcut compilation into an optional isolated service/image so the core MCP/OpenAPI gateway does not install the legacy dependency.
4. Disable the legacy module at build/runtime for deployments that do not need Siri Shortcuts.

Acceptance criteria

• npm audit --omit=dev reports no unresolved production advisories, or an explicitly documented and narrowly scoped exception remains.
• Existing Shortcut fixtures still compile to a valid bplist00 artifact.
• Token escaping, HTTPS target validation, TTL, store bounds, and single-use download behavior remain covered by tests.
• README, threat model, architecture, and changelog are updated.

Current mitigation

The high-severity transitive advisories have been removed from the lockfile. CI blocks high-severity production advisories. Generated artifacts remain memory-only, random, TTL-limited, bounded, and single-use.