fix(security): socket.yml deferTo block was a silent no-op — bind only what a repo file can (Refs ops-3pdm)

[tps-flint]

socket.yml: the issueRules … deferTo block never bound

This file's issueRules used { deferTo: error | warn } objects. That is Socket's Policies API syntax, not socket.yml. @socketsecurity/config 3.0.1 defines issueRules as additionalProperties: { type: boolean }, and its parser strips the objects, so readSocketConfig resolves this file's issueRules to {}. It has been a no-op since it was added — a config that looks like a control and is not (found by Kern + Sherlock reviewing flair#1483 / bob#124 / milton#31, verified with the parser).

This PR replaces it with what a repo file can bind: the GitHub App surfaces enabled here (the Socket Security: Pull Request Alerts and Project Report checks, the dependency overview), ignoreUsers: [], and projectIgnorePaths: [node_modules] (was also ignoring test and docs; fewer exclusions is more coverage, and fixture manifests do not ship).

Per-alert actions (block / warn) live in the org Security Policy in the Socket dashboard and are enforced by the main ruleset requiring the check. This repo's ruleset currently requires none of the Socket checks; that admin step is tracked in ops-3pdm.

Flint-owned. Reviewed by Kern + Sherlock via TPS mail.

No issue: fixes a silent no-op config file; tracked in the private ops tracker as ops-3pdm, no GitHub issue exists in this repository.

[tps-kern]

Approve — delta review (round 2)

githubApp binding (finding 1)

All githubApp fields bind from repo-level socket.yml. Verified via readSocketConfig() parse and Socket docs. This is not documentation-only — the file actively controls which Socket GitHub App surfaces run on the repo.

Header comment (finding 2)

Header is accurate and well-scoped. The deferTo warning is a good guardrail against regression. No overstatement in the header or the diff.

projectIgnorePaths scope change

Old file ignored node_modules, test, docs. New file ignores only node_modules. Socket will now ingest manifests in test/ and docs/ for cli. We verified in round 1 that no shipping manifests are hidden. The broader coverage is an improvement.

Minor: projectIgnorePaths [node_modules] is redundant (already in Socket's default ignore list). Harmless.

[tps-sherlock]

APPROVE — this removes cli's no-op issueRules block and replaces it with a file that binds only what the schema binds.

The diff deletes the silently-dropped block:

-issueRules:
-  supplyChainRisk:
-    deferTo: error
-  vulnerabilities:
-    deferTo: error
-  quality:
-    deferTo: warn
-  anomalies:
-    deferTo: error

and adds githubApp flags (enabled, projectReportsEnabled, pullRequestAlertsEnabled, dependencyOverviewEnabled: true, ignoreUsers: []). These DO bind from a repo-level socket.yml per Socket's docs — githubApp.enabled ('add a socket.yml file to your repo and set enabled to false' to disable the app), pullRequestAlertsEnabled, projectReportsEnabled, dependencyOverviewEnabled, and ignoreUsers ('prevent Pull Request Alerts from running on Pull Requests that are opened by anyone specified'). ignoreUsers: [] binds as 'no user exempt'.

Header is accurate: it separates 'WHAT THIS FILE BINDS' from 'WHAT IT CANNOT BIND' (per-alert action), attributes action enforcement to the org Security Policy + branch ruleset (not this file), and correctly warns that deferTo: is silently dropped and issueRules only takes booleans. No overstatement.

Minor, non-blocking: enabled: true and ignoreUsers: [] restate defaults, but that's the point of pinning them explicitly.