Harden npm dependency audit posture

Wayne authorized one-time admin bypass of PR #143 required-review gate only. Scope: narrow dependency hygiene PR. Landing advisories clear to zero; SDK Jest/Istanbul dev-tooling advisories remain deferred. NO-GO: production promotion. NO CLAIM: production-ready or full dependency hygiene complete.

Author: matt-dean-git