ci(audit): add dev-dependency audit step at critical severity (#1479)

* fix(deps): remove malicious tree-sitter-erlang, fix 3 moderate vulns

Removes the WhatsApp/tree-sitter-erlang devDependency flagged as
malware (GHSA-rphw-c8qj-jv84, CWE-506). The committed WASM in
grammars/ was validated clean (correct export name, no disallowed
imports) — Erlang grammar support is unaffected.

Also runs npm audit fix to bump hono (→4.12.25), protobufjs (→7.5.8),
and qs (→6.15.2) to their patched versions. All three were transitive
deps; no direct-dependency changes required.

See scripts/build-wasm.ts for instructions on rebuilding the Erlang
WASM from a safe source if needed.

* fix(lock): restore libc discriminators for @optave/codegraph-linux-* packages

npm install on macOS strips the libc field from linux optional entries when
regenerating the lockfile. Restore the glibc/musl discriminators that were
lost during the npm audit fix run so CI libc-discriminator check passes.

* fix(ci): remove tree-sitter-erlang from grammar version parity check

The devDependency was dropped (GHSA-rphw-c8qj-jv84 malware advisory).
Keeping it in the GRAMMAR_NPM_PACKAGES list causes the grammar version
parity CI check to fail with 'listed in check but absent from devDependencies'.

* fix(tests): skip erlang parser tests when WASM is unavailable

With tree-sitter-erlang removed from devDependencies, the WASM is no
longer built on npm install. The tests threw 'Erlang parser not available'
causing 14 hard failures. Add an erlangAvailable guard to each test so
they pass (no-op) instead of failing when the grammar is absent.

* fix(benchmarks): exempt erlang resolution regression in guard

Removing tree-sitter-erlang causes erlang precision/recall to drop from
100% (3.12.0 baseline) to 0% since the WASM is no longer built.
Add KNOWN_REGRESSIONS entries for the expected erlang precision and recall
drops so the pre-publish benchmark gate passes.

* fix(docs): correct build-wasm.ts comment about erlang WASM status

The previous comment incorrectly claimed 'The grammar WASM is committed
in grammars/'. grammars/*.wasm is gitignored; the WASM is not tracked in
the repository. Rewrite the comment to accurately describe the situation
and provide complete restoration steps.

* ci(audit): add dev-dependency audit step at critical severity

The existing audit job uses --omit=dev, making it blind to critical
advisories in devDependencies (e.g. GHSA-rphw-c8qj-jv84, the malicious
tree-sitter-erlang package that prompted this). Adding a second step
that audits all packages at critical-only so malware-level advisories
in devDeps are caught at PR time without noisy high/moderate churn.

* fix(test): use parsers.get not parsers.has to detect erlang WASM availability

parsers.has('erlang') returns true even when WASM loading fails because
doLoadLanguage sets the key to null on error. Use !!parsers.get('erlang')
so the suite skips correctly when the grammar is absent.

Author: carlos-alm

.github/workflows/ci.yml

@@ -180,6 +180,12 @@ jobs:
         # abort the audit before it can report real vulnerabilities.
         run: npm audit --omit=dev --audit-level=high --package-lock-only
 
+      - name: Audit dev dependencies (critical only)
+        # Catches malware/critical advisories in devDependencies (e.g. GHSA-rphw-c8qj-jv84).
+        # Scoped to critical only — high/moderate in devDeps are acceptable noise since
+        # they never reach production. --package-lock-only avoids installing packages.
+        run: npm audit --audit-level=critical --package-lock-only
+
   verify-imports:
     runs-on: ubuntu-latest
     name: Verify dynamic imports