fix(ci): make production dependency audits advisory

[mldangelo-oai]

Summary

• Keep production dependency audits visible in Node CI and npm releases without letting unavailable remediation block the repository.
• Preserve the existing manual audit:prod command and all other build, test, package, and release gates.
• Add a regression test covering both workflow audit steps.

Verification

• env XDG_CACHE_HOME=/private/tmp/codex-security-bun-cache pnpm dlx bun@1.3.14 test --timeout 30000 ./tests-ts/skeleton.test.ts ./tests-ts/release-automation.test.ts (187 passing)
• pnpm run types
• pnpm run format

Dependency findings remain visible in Actions logs, but are advisory until a patched package is available through the approved registry.

[mldangelo-oai]

@codex review exact head 7af9939

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 7af99398b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 7af99398b1

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.