[lucaspimentel]

What does this PR do?

• Run a fresh dependency audit inside the NPM publication job after its existing Production approval, and inside the draft-release job before ZIP/draft creation.
• Pin and checksum-verify cargo-audit 0.22.2, use a fresh advisory database and Cargo cache on every attempt, and reject incomplete scans even when the scanner exits successfully.
• Bind the scan to the build source SHA and committed lockfile/audit policy; use explicit producer checkouts and --locked for all release builds.
• Add focused, table-driven offline tests and a read-only test workflow with opt-in real-scanner smoke coverage.

Motivation

Establish strict publication-time enforcement before considering changes to merge-time enforcement. Findings, installation/refresh failures, timeouts and incomplete index checks must block publication, including on retries or with inherited warm caches.

Additional Notes

• Existing PR/scheduled scans, required checks, mergegate, audit exceptions and informational-warning treatment are unchanged. No new suppressions, severity filters or bypass inputs.
• Build-only paths and existing approvals are preserved. Draft releases gain no new environment approval; later draft-to-public promotion and Lambda changes are outside this scope.
• Existing unsuppressed zstd advisories correctly block the repository gate; dependency remediation is separate.
• The terminal-output guard is coupled to cargo-audit 0.22.2 and must be reviewed when upgrading the scanner.

Describe how to test/QA your changes

• Offline gate, report-guard and workflow tests pass locally and on GitHub Actions.
• Real-scanner smoke passes locally for clean scans/retries, findings blocked until fixture exceptions are committed, and informational warnings. Scanner preflight also passed in a disposable Ubuntu 24.04 amd64 container.
• Disposable-copy probes detect an unlocked build, a gate moved after publication, an increased download timeout and a removed incomplete-index guard.
• The latest local Rust workspace run passes with test_mini_agent_tcp_handles_requests explicitly excluded for the known port-8126 collision. Doctests pass with existing ignores unchanged.
• Bash syntax, ShellCheck and workflow syntax validation pass. ShellCheck-enabled actionlint reports only the pre-existing unquoted $HOME in the shared builder.

This remains a draft: complete the build matrix and non-publishing release-job integration validation before marking ready. Local sentinel tests exercise failure/retry blocking, but do not prove deployed publication wiring. No production publication, signing, release upload or registry push was used for testing.

Reproduction commands and fixture provenance: test README.