chore(deps): audit + bump vulnerable/outdated deps; add minimumReleaseAge guard; docs accuracy pass

[PAMulligan]

Weekly Dependency + Security Sweep (Wk 3) — onboards Vespasian to the PMDS sweep rotation. Closes #2.

Security — pnpm audit: 12 vulnerabilities (8 high, 4 moderate) → 0

All fixes via scoped pnpm.overrides (transitive deps; lockfile regenerated with pnpm, never hand-edited):

Package	Override	Advisory	Came in via
esbuild	>=0.28.1	dev-server request forwarding (GHSA-67mh-4wv8-2f99)	electron-vite → esbuild 0.21.5
js-yaml@3	>=3.15.0 <4	merge-key quadratic DoS	@lhci/utils → 3.14.2
js-yaml@4	>=4.2.0 <5	merge-key quadratic DoS	commitlint/cosmiconfig, electron-builder (22 paths)
tar	>=7.5.16	7 advisories (path traversal, symlink escape, …)	electron-builder → app-builder-lib → tar 6.2.1
ws@7	>=7.5.11 <8	fragment memory-exhaustion DoS	@lhci/cli → ws 7.5.10
ws@8	>=8.21.0 <9	fragment memory-exhaustion DoS	puppeteer-core → ws 8.20.1

• @babel/core was already at 7.29.7 (≥ 7.29.6 target) — no action needed.
• Overrides are capped per major deliberately: an uncapped >= floated js-yaml 3.x consumers onto 5.2.1 (which drops the safeLoad API @lhci uses) — caught and fixed before commit.
• tar 6 → 7 is the one major bump (as flagged in the sibling sweeps). Verified require('tar') from app-builder-lib still exposes the classic c/x/t/create/extract API on 7.5.19.

Outdated deps (in-range bumps)

playwright 1.60.0 → 1.61.1 (exact pin, all 3 packages), fast-xml-parser, fflate, zod 3.x, tsx, typescript, typescript-eslint, electron, electron-builder, commitlint, pixelmatch, @types/*. Majors (react 19, vite 8, eslint 10, electron-vite 5, zod 4, …) intentionally left for dedicated upgrade PRs, not a weekly sweep.

minimumReleaseAge guard

Checked all four siblings first, per the issue: none carries a minimumReleaseAge config (only Nerva has any dependency automation — a plain dependabot.yml). Added .github/dependabot.yml modeled on Nerva's structure plus Dependabot cooldown (7-day default, 14-day majors) — Dependabot's equivalent of Renovate's minimumReleaseAge — for both npm and github-actions ecosystems.

⚠️ Owner action still required: enable Dependency graph + Dependabot alerts in Settings → Security (repo-settings change, out of scope for this PR).

Docs accuracy pass

• Added release / pipeline-tests / security-audit / node / pnpm / license badges (README previously had none).
• Verified counts: 54 agents (.claude/agents/*.md), 10 skills — README claims match.
• Sibling cross-links (Aurelius, Claudius, Flavian, Nerva) present and correct.
• Quick-start verified: pnpm install + wizard scripts run cleanly on this tree.

Tests

• pnpm test:all — 54 + 124 + 55 pass (init / pipeline / wix-driver)
• pnpm test:canva-e2e — 6 pass (CI site-validation gate)
• pnpm gui:test (63 pass) · gui:typecheck · gui:build (exercises the esbuild 0.28.1 override through electron-vite/vite)
• commitlint smoke-tested against the new js-yaml 4.3.0
• pnpm audit clean

🤖 Generated with Claude Code