Approval gates and runtime controls

Merging two green branches erased a HIGH-severity fix from package.json

A developer spent a week on an agent that bumps vulnerable dependencies and repairs the breakage, and the repairs were the easy part; his log of how each failure reported success while being wrong is the useful artifact.