Audit complete dependency lockfile in CI

[PathGao]

Fixes #313

Changes the pull-request security gate from a production-only audit to npm audit of the complete resolved lockfile. Build dependencies parse project input during development and release builds, so excluding them hid the SvelteKit/Svelte/Vite findings addressed in #310.

Updates the workflow regression test to require the complete audit and reject a production-only command.

This is stacked after #312 (and therefore #310). Merge the predecessor chain first.

Validated with npm ci, npm audit (0 vulnerabilities), npm run check (0 errors, 0 warnings), npm test (136 passing), npm run build, and cargo test (21 passing).

[PathGao]

@alecdotdev This is the policy follow-up to #310: the PR gate now audits the complete lockfile, including build dependencies that process repository input. It is stacked after #312 and its predecessors; please review in that order.