fix: enforce high-severity dependency security gate

[coeasy]

Summary

Closes the high/critical npm dependency audit findings and makes dependency security a permanent CI gate for both the root runtime/tooling project and the Astro site.

Remediation

• upgrades wrangler from 3.x to ^4.126.0
• upgrades @cloudflare/workers-types to the Wrangler 4-compatible 5.x peer range
• upgrades vitest to ^4.1.11 to leave the vulnerable legacy Vite/esbuild dependency path
• refreshes the site lockfile to a non-vulnerable sharp / libvips chain
• lockfiles were generated by npm with lifecycle scripts disabled; no hand-edited integrity metadata

Permanent security gates

• adds read-only Dependency Security workflow for root + site
• both projects run locked npm ci followed by npm audit --audit-level=high
• existing CI also runs the high/critical audit before functional tests
• no dependency-repair write job remains in the final workflow

Validation

• root high/critical audit: success
• site high/critical audit: success
• CI / Ecosystem CI / Ecosystem Platform / Phase 7 / Phase 8: success
• Runtime 0.1.0 Linux, macOS and Windows matrices: success
• full tests, site check/build, Registry gate, npm package smoke, runtime syntax: success

Invariants

• DSH runtime/public version remains 0.1.0
• remote APIs remain /api/v1
• Registry schema remains V3
• deployment behavior remains routed through the existing authoritative Deploy Router