Sprint 17.B — Verify vendored dependency provenance and static resources

[maruson08]

Goal

Audit the production dependency and static-resource surface without opportunistic upgrades.

Acceptance criteria

• Inventory each vendored production dependency.
• Verify required version, license, provenance, approved files, and runtime hashes.
• Preserve secure-metadata v0.1.0 bytes and provenance.
• Confirm same-origin loading with no runtime CDN, npm, or GitHub artifact fetch.
• Add tests only for concrete coverage gaps.

[maruson08]

Completed in PR #44. Vendored versions, provenance, licenses, inventories, and hashes passed. Official npm latest versions match. Dependabot alerts are disabled, so alert visibility remains explicitly unavailable.