ci: ignore GHSA-gv7w-rqvm-qjhr (esbuild) until patch matures

The high-severity esbuild advisory's only fix (0.28.1) was published
2026-06-11 and is blocked by our minimumReleaseAge 7-day supply-chain gate
until ~2026-06-18, so the audit step started failing on an unrelated push.
esbuild is dev-tooling only (vite/vitest/drizzle-kit), never in the prod
bundle, and the advisory requires an attacker-controlled NPM_CONFIG_REGISTRY
in Deno. Temporarily allowlist the GHSA; remove once the override installs
cleanly past the maturity gate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Dictera

pnpm-workspace.yaml

@@ -1,6 +1,16 @@
 packages:
   - '.'
 
+# Temporary audit ignore: GHSA-gv7w-rqvm-qjhr (esbuild high).
+# The patched esbuild 0.28.1 was published 2026-06-11 and is blocked by our
+# own minimumReleaseAge (7-day) gate below until ~2026-06-18. esbuild reaches
+# us only via vite/vitest/drizzle-kit dev tooling (never the prod bundle), and
+# the advisory needs an attacker-controlled NPM_CONFIG_REGISTRY in Deno — not
+# our threat model. Remove this entry once the override can install cleanly.
+auditConfig:
+  ignoreGhsas:
+    - 'GHSA-gv7w-rqvm-qjhr'
+
 # Minimum 7 days after publish before install (supply chain security)
 minimumReleaseAge: 10080
 minimumReleaseAgeStrict: true