Add dependency security floor as separate CI policy

[StatPan]

Goal

Add the dependency security gate without coupling it to approval/SSE changes.

Derived from #14 Phase 6 dirty branch handoff.

Scope

• Review the package/version floors and whether they belong in prebuild, CI, or both.
• Keep React/React DOM lockfile changes in this PR if still required.
• Document how to update the floor when advisory state changes.

Out of Scope

• Do not change approval/question runtime behavior.
• Do not combine with PR fix: Phase 6 review follow-up — shared util, GET side-effect, dead branch, test gap #13 or the OpenCode compatibility issue.

Acceptance Criteria

Functional:

• Security check passes locally and in CI.
• The policy does not recurse into irrelevant package manifests or generated/vendor directories.
• Failure messages clearly name package, location, found version, and required floor.

Code/product quality:

• The policy is maintainable when advisory versions change.
• CI/prebuild placement is justified and does not create surprising local build failures.

Verification

• node scripts/check-security-deps.mjs
• ./node_modules/.bin/tsc -p tsconfig.json --noEmit
• CI run on PR.

Expected Delivery

• Delivery mode: separate PR from approval/SSE changes.
• Review mode: verify CI behavior and policy scope.
• Merge mode: merge only if the gate is explicit and maintainable.