ci: scope dependency audit to production deps only

npm audit --audit-level=high was failing on 3 devDependency-only
vulnerabilities (esbuild/vite/vitepress, transitive through vitepress's
docs tooling). None of these ship in the published package (files
whitelist is dist/, README.md, CHANGELOG.md, LICENSE only), and there is
no available fix that doesn't break docs:build (esbuild 0.28.1 breaks
vite 5.4.21's destructuring transform for legacy browser targets).
Scoping the audit to --omit=dev makes the check reflect actual shipped
risk; confirmed it passes clean (0 vulnerabilities).

Author: gilpanal

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
         run: npm ci
 
       - name: Audit dependencies
-        run: npm audit --audit-level=high
+        run: npm audit --omit=dev --audit-level=high
 
       - name: Type-check declarations
         run: npm run typecheck