chore: harden dependency resolution

[stevewesthoek]

What changed

• repository hardening and clean-baseline documentation from the current main baseline
• protected staging-gate checks and deterministic PR validation
• a governed current-main production migration-ledger verifier
• canonical Payload/Prisma migration evidence reporting with deployed-SHA comparison
• strict production read-only transaction safety tests
• patched dependency resolutions and lockfile updates
• removal of four invalid tracked .claude/worktrees/* gitlinks plus a local-worktree ignore rule

What did not change

• no production data, CMS content, users, profiles, memberships, media, or operational records were changed
• no production migration, rollback, reset, seed, restore, or database write was performed
• no production deployment or staging-to-production synchronization occurred
• no product feature behavior was intentionally introduced
• the historical feature/member-portal-rooms runner is not used
• local primary and legacy worktrees were not modified

Validation evidence

• PR head: 31c79574854ec6fc70e3e094da3d3537c112c6cd
• required CI Validate, build, and test: PASS — run 33734118839, 4m51s
• pnpm test:release: 182/182
• production verifier safety test: PASS
• TypeScript no-emit check: PASS
• full candidate production dependency audit: no known vulnerabilities
• release manifest and status-document checks: PASS
• all workflow action references are full SHA-pinned
• invalid worktree gitlink warning is resolved; git submodule status --recursive is clean
• hardening worktree is clean; the separate primary user worktree remains intentionally preserved

Dependency and secret triage

• Fresh default-branch Dependabot state: 11 open alerts — 5 high and 6 medium. This increased from 8 because two high fast-uri alerts and one moderate qs alert were published after the previous report.
• Candidate remediation: all 11 known default-branch findings are resolved in the candidate lockfile with patched versions. The high findings cover transitive brace-expansion toolchain paths and fast-uri; the moderate findings cover transitive Payload/Monaco, Next/PostCSS, New Relic/OpenTelemetry/Protobuf, esbuild tooling, and the direct Stripe-to-qs path.
• Fresh candidate graph: stripe@16.12.0 resolves qs@6.16.0; full production audit reports no known vulnerabilities.
• Fresh secret-scanning state: 3 open alerts, all validity: unknown, with no resolution recorded: 1 Stripe Test API Secret Key and 2 Stripe Webhook Signing Secret findings. Values are intentionally omitted. Locations are in historical tracked documentation/configuration paths on main; no secret files or secret stores were changed.
• Code-scanning API returned no analysis; there are no code-scanning findings available to triage.

Required external security actions:
EXTERNAL SECURITY ACTION REQUIRED — authorized credential owner must revoke/rotate Stripe Test API Secret Key.
EXTERNAL SECURITY ACTION REQUIRED — authorized credential owner must revoke/rotate the two Stripe Webhook Signing Secret credentials.

Read-only safety review

• The PR changes only documentation, CI, release evidence/verifier code, staging-gate controls, dependency resolution, and repository metadata cleanup; it does not change product src/ behavior.
• The production verifier uses exact production topology guards, a read-only transaction, bounded metadata queries, and ROLLBACK; its tests reject mutation SQL, migration/reset/seed commands, staging targets, wrong environment, and secret output.
• No production, staging, legacy, CMS, user, data, migration, synchronization, or deployment mutation was executed during this triage.
• The corrected workflow/action scan is clean and all changed workflows use full SHA-pinned actions.
• The maintained production verifier was validated through static/mock tests only; no live production credentials or database connection was used.
• CI emits a non-failing Node.js 20 deprecation warning for the pinned checkout/setup actions; this is recorded as informational follow-up and no broad action upgrade was introduced.

Read-only governance observations

• main protection requires one approving review and the Validate, build, and test status check
• admin enforcement is enabled; force-push and branch deletion are disabled
• Dependabot updates, secret scanning, and secret-scanning push protection are enabled
• PR chore: harden dependency resolution #30 remains open and mergeable but blocked by the required human approval
• current review threads: 0 unresolved

Reviewer focus

1. production data and migration safety
2. branch and governance protections
3. CI/workflow hardening and SHA pinning
4. absence of unrelated product changes
5. release and rollback safety
6. dependency remediation and external credential rotation actions
7. repository metadata cleanup and the remaining non-failing Node.js deprecation warning

Post-approval closeout checklist

1. Reverify PR head, one independent approval, required CI, and zero unresolved threads.
2. Merge only through the protected GitHub path; do not bypass branch protection.
3. Verify the final main commit and required checks, then refresh Dependabot and secret-scanning state.
4. Run the maintained production migration verifier only in its exact read-only mode with operator-supplied production evidence; do not run migrations, rollback, reset, seed, restore, sync, or data writes.
5. If staging promotion is separately authorized, use only the guarded current-main staging path and record its evidence; no staging mutation is part of this PR.
6. Perform any later production deployment only under a separate explicit release authorization and the protected deployment procedure.
7. Record the final security-rotation and release evidence in the operator handoff.
8. Schedule the pinned GitHub Actions Node.js runtime maintenance separately before the warning becomes a hard failure.

Remaining action

Technical pre-merge work is complete. The PR still requires an independent human approving review. The credential-owner rotation actions above remain external security operations; Codex cannot perform or attest to them. No production or staging mutation is authorized by this PR.