docs: add Dependency Management section to README

[paradoxbound]

Summary

• Adds a Dependency Management section to README.md documenting how dependencies are selected, obtained, and tracked
• Satisfies OSPS-DO-06.01: "When the project has made a release, the project documentation MUST include a description of how the project selects, obtains, and tracks its dependencies"

Justification text for badge questionnaire

Dependencies are declared in packages/core/package.json and packages/stdio/package.json and locked in package-lock.json. All installs use npm ci. Updates and vulnerability tracking are handled by Dependabot (weekly), npm audit (every CI build), OSV Scanner, and Trivy. See the Dependency Management section in README.md.

🤖 Generated with Claude Code