fix(ci): enforce exact audit exception policy

[devswha]

Summary

• refresh compatible dependency locks to remove all actionable high-severity findings
• pin the current GJC runtime at 0.13.1 so the security refresh does not silently change SDK contracts
• override only release-it -> undici to patched 7.29.0
• replace the raw audit gate with an exact, visible, expiring exception for GHSA-jmr9-qjv8-65gv

The exception permits only the no-fix @gajae-code/coding-agent -> @puppeteer/browsers -> extract-zip graph, fails when a fix becomes available, and expires on 2026-10-01. Moderate React Router findings remain visible.

Verification

• npm ci
• npm run audit
• npm run typecheck
• npm run check:core
• npm test (416 server + 154 client and Bun contract suites passed after fetching pinned Bun)
• npm run lint
• npm run check:identity
• npm run build

Closes #2