ci: harden build-check (matrix, permissions, concurrency) + coverage, audit, dependabot

[neo-lyzr]

Summary

Strengthens the Node CI. (For reference, the Node repo already had the strongest core gate of the three cloudrift repos — it's the only one running lint + format + typecheck in CI; Go runs vet only, Py runs neither.) This PR closes the remaining gaps.

P0 — hardening (build-check.yml)

• Top-level permissions: contents: read (was unset → inherited the broad default token).
• concurrency: block that cancels superseded runs on the same ref (saves minutes on PR force-pushes).

P1 — correctness & supply chain

• Node 20 + 22 matrix — engines declares >=20 but CI only proved 22; now both the LTS floor and current are tested.
• npm audit --audit-level=high --omit=dev step (prod deps only; currently 0 high/critical).
• .github/dependabot.yml — weekly npm + github-actions updates (config-only, no runner cost).

P2 — fill half-built features

• Coverage now works: vitest.config.ts referenced v8 coverage but @vitest/coverage-v8 was never installed, so --coverage failed. Added the dep + a one-shot Coverage step (text summary, Node 22 leg). Current coverage: 93% statements / 88% branches.
• AWS-emulator job (LocalStack via testcontainers): added as a separate job gated to push-to-main and PRs labelled run-emulator, so it doesn't add ~1-2 min to every PR.

Validation

• npm run format:check: PASS (new YAML + package.json conform).
• npx vitest run --coverage: PASS — 536 tests, coverage summary emitted (feature was previously broken).
• npm audit --audit-level=high --omit=dev: 0 vulnerabilities (the 12 audit findings are all dev-only deps, which don't ship — hence --omit=dev).

Notes

• Not included (deliberate): Node 24 (not LTS; @types/node pinned to 22), live-lane in CI (needs real cloud creds — keep manual), CodeQL (audit+dependabot cover most supply-chain value here), npm publish (UNLICENSED, tag-is-the-release model). Release CI is handled separately in ci: add tag-triggered GitHub Release workflow #2.
• The emulator job is not exercised by this PR's checks (gated off unlabelled PRs). To smoke-test it here, add the run-emulator label to this PR; otherwise it first runs on merge to main. It was not verifiable locally (needs Docker/LocalStack).