[usavkov-epam]

Adds additive @lingva/core guarded approval types, named actions, deterministic request builders and sanitized response parsers. Callers provide explicit scope, context token and operation UUID; the codecs preserve identities, validate serialized UTF-8 limits and never infer authorization. Existing authoring contracts and all Lingva package versions/licenses remain unchanged.

The PR also repairs the existing workspace dependency-audit blocker so the new contracts can be verified against a maintained dependency graph:

• Update the Next starter to 16.4.1, Nuxt to 4.6.2 and SvelteKit to 3.0.0, with targeted patched transitive resolutions.
• Scope TypeScript 6.0.3 and the required adapter/configuration migration to the SvelteKit starter. Locale logic and public SDK requirements remain unchanged.
• Run mandatory nuxt typecheck before production bundling. The duplicate Vite checker shell-splits absolute project paths containing spaces; its optional development overlay is disabled.
• Apply a local deepmerge 4.3.1 key-guard patch to source and shipped CJS/UMD artifacts. This is a local mitigation, not a claimed upstream release. An unconditional installed-artifact/lock-graph suite prevents an additional version or unpatched snapshot from hiding behind the one exact advisory exception.

Validation completed locally:

• All 250 core tests, including 123 focused codec cases, pass. The reviewed optional-variant descriptor bug is fixed with assertion RED/GREEN coverage.
• 23 installed-artifact/graph security tests pass; 18 exploit cases and the graph guard were observed failing before their respective repairs, with ordinary merge controls passing.
• 70 workspace verification tasks,19 complete workspace builds and all 11 public package builds/isolated ESM/CJS/TypeScript consumers pass, including license and public-build boundaries.
• Frozen installation and peer checks pass.
• 10 production HTTP scenarios and six real browser locale states pass across Next/Nuxt/SvelteKit. Console observations contain only missing favicon 404 requests.
• One independent review of the core contract and one separate fresh review of the dependency repair are complete. The repair review found no Critical/Important/Minor issues.

Production audit exits 0 with no active advisory objects under the explicitly documented exception policy. It still reports two ignored patched-artifact findings: the existing node-forge exception and the new exact deepmerge GHSA-gcqx-w48m-w2h4 exception. The existing braces exception remains unchanged. This is not an exception-free audit claim. See docs/specs/workspace-dependency-security.md for patch provenance, removal conditions, compatibility tradeoffs and rollback.

HTTP helpers, CLI/adapters, server/storage/permission behavior, package publication and deployment remain outside this PR. At head e962e60, CI complete, workspace/docs/native checks and all 22 Snyk security checks pass. Entire reports only missing reviewer approval; Checks, Findings and Up to date pass. No approval bypass or merge has been performed.