chore: harden dependency installation and reduce tooling

[HDauven]

Summary

• update every currently vulnerable dependency path, including the newly disclosed PostCSS issue and the complete brace-expansion follow-up remediation
• replace rimraf with Node 24's built-in recursive removal and remove five packages from the installed graph
• enforce a seven-day package cooling-off period over the committed monorepo lockfile, with exact reviewed emergency exceptions
• install without lifecycle scripts, verify registry signatures, then rebuild only exact approved packages
• pin GitHub Actions to immutable revisions, disable persisted checkout credentials, scope Pages/OIDC permissions to deployment, and move CI to Node 24/npm 11.18.0

Closes #285.

Dependency changes

The lockfile now resolves:

• brace-expansion to patched 1.1.18 and 5.0.9
• js-yaml to patched 3.15.0 and 4.3.0
• fast-uri to patched 3.1.4
• linkify-it to patched 5.0.2
• postcss to patched 8.5.25

Removing rimraf also removes glob, minipass, package-json-from-dist, and path-scurry, reducing the lockfile from 946 to 939 registry entries and from 830 to 825 unique registry packages.

Trust boundary

All three workflows now validate release ages before installation, install with --ignore-scripts, verify registry signatures, and rebuild only esbuild@0.28.1 and unrs-resolver@1.12.2 on Linux. fsevents@2.3.3 remains explicitly approved for supported local macOS installations. The Storybook build job has read-only repository access; Pages and OIDC write permissions are granted only to the deployment job.

The release-age verifier understands npm workspaces: it permits only directory links declared in the root workspace list and rejects undeclared local, Git, file, and remote package sources. The emergency exceptions for brace-expansion@1.1.18, brace-expansion@5.0.9, and postcss@8.5.25 expire on 2026-08-07 and become invalid as soon as they are no longer needed.

OIDC trusted publishing is intentionally not included. Issue #207 requires trusted-publisher configuration for all 14 publishable npm packages before removing NPM_TOKEN from the release workflow.

Audit note

npm audit --omit=dev reports zero findings. The full development audit may still propagate GHSA-mh99-v99m-4gvg through tooling parents because the advisory metadata has not recorded the newly published 1.x backport. The upstream 1.1.17/1.1.18 diff contains both the bounded-output remediation and follow-up sequence-length fix; forcing CommonJS consumers to ESM-only 5.x would be a compatibility regression. The compatible 5.x path is pinned to 5.0.9, which includes the aggregate comma-alternative and padded-sequence bounds missing from 5.0.8.

Verification

• 939 lockfile entries across 825 registry packages pass the seven-day check
• 818 installed packages have verified registry signatures; 179 also have attestations
• formatting and linting pass, including the new repository scripts
• all type checks pass with zero Svelte errors or warnings
• 630 tests pass across the tested workspaces
• Storybook production build succeeds
• TypeDoc generation succeeds
• all 15 workspaces pass npm pack --dry-run
• all workflows pass actionlint

[changeset-bot]

⚠️ No Changeset found

Latest commit: dbefbc1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR