Socket.dev remediation

A security housekeeping release: four Socket.dev supply-chain findings remediated, and npm audit back to clean.

A security housekeeping release. We remediated four findings surfaced by Socket.dev's supply-chain analysis and brought npm audit back to clean.

What changed

• Four Socket.dev findings remediated, dependency and metadata issues flagged by Socket.dev's static analysis were resolved at the source (#977, #978, #979).
• Readable, auditable source, the published package keeps its source legible so anyone can verify exactly what ships, and a SECURITY.md documents how to report issues.
• `npm audit` clean, no known advisories remain in the dependency tree.

We hold our own supply chain to the same standard we hold yours: verifiable, minimal, and clean.