fix: remediate code scanning findings

[cucuwang]

Problem and change

Replace the two quadratic regex paths and HTML test assertions, pin release-consumer installs to the source lockfile, and add security property tests and a private-report link. The remediation guide records the remaining review, historical SAST and Best Practices requirements.

Validation and impact

• Tests/build pass. npm run release:check passed on Node 22.23.2 and 24.11.1 with 263 tests, zero npm audit vulnerabilities and byte-identical tarballs.
• CLI, API, JSON and Action contracts preserved. Existing tests, the Action contract and all three installed CLI aliases passed.
• Security and dependency impact reviewed. CodeQL 2.27.0 went from four findings to zero; Scorecard v5.3.0 reports 10 for Pinned-Dependencies, Security-Policy and Fuzzing. fast-check is a pinned development dependency.
• Scoring/methodology impact stated. Scoring weights and JSON schemas are unchanged; parser and rendering regressions have fixtures.
• Documentation and changelog updated where relevant. Security reporting, fuzzing and per-alert remediation documentation are updated; this PR does not create a release.
• Release/package impact and maintainer steps stated. Consumer verification now requires the matching checkout lockfile and rejects invalid tarballs before installation. GitHub settings and external badge registration remain separate steps.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.