[security] Fix baseline npm audit advisories blocking repo checks

[WalksWithASwagger]

Problem

Clean origin/main currently fails the repo-wide npm run check gate at the final npm audit --audit-level=moderate step.

The functional gates before audit pass, but audit reports 3 high-severity advisories:

• brace-expansion <=1.1.16
• fast-uri 3.0.0 - 3.1.3
• sharp <0.35.0

This is now blocking unrelated PRs such as #179 even when eval/docs/tests pass.

Evidence

Verified on a detached clean worktree from origin/main (075f1e0):

npm audit --audit-level=moderate

Result: same 3 high-severity advisories.

Verified again on PR #179: remote eval check passes eval, docs, index hygiene, agentic pytest, and python compileall, then fails only at npm audit with the same advisories.

Scope

• Run npm audit fix and inspect resulting lockfile changes.
• Evaluate whether sharp@0.35.3 is safe despite npm marking it as a breaking update.
• Run image/build/eval checks after dependency changes.
• Keep this as a focused dependency/security PR; do not mix with SEO/content changes.

Acceptance criteria

• npm audit --audit-level=moderate passes or remaining advisory is documented with a justified exception.
• npm run check passes on a clean worktree.
• Any sharp update is verified against image-related scripts that depend on it.
• PR body includes exact audit/check output.

Guardrails

No production deploy, DNS, credential, or public posting changes. Stop at PR boundary unless Kris explicitly approves merge.