M5-05: record security audit and release no-go

[pillowtalk-Qy]

Closes #54

Records the M5 security, secret, dependency, and trust-boundary audit at exact head 99509099b816dfea2c1d60573d6dea63f03d9b3e.

Verdict: NO-GO until P0 #102 remediates the six production dependency advisories. No other confirmed P0/P1/P2 finding was identified.

Verification:

• pnpm check (49 files, 1,258 tests, 100% coverage)
• fixture and live-mode Playwright suites (8 pass/2 skip and 9 pass/1 skip)
• clean detached-worktree pnpm install --frozen-lockfile && pnpm check
• production audit reproduced 4 High and 2 Moderate advisories
• tracked-secret, GitHub secret-scanning, boundary, rendering, redaction, provenance, and public-health checks documented in the report