Revert npm audit gate to full tree once GHSA-mh99-v99m-4gvg is fixable in the dev tree

[indigo423]

Follow-up to #136 / #137. The audit gate in make audit / make verify runs with --omit=dev because brace-expansion <=5.0.7 (GHSA-mh99-v99m-4gvg) has no fix compatible with eslint 9 / eslint-config-next's minimatch@3 chain.

When eslint / eslint-config-next's plugins move off minimatch@3 (check with npm ls minimatch brace-expansion), remove --omit=dev from both audit invocations in the Makefile and drop the comment above the audit target.

[indigo423]

Decision record (2026-07-28):

Strategy: wait for a brace-expansion 1.x backport ("door A"). No eslint 10 bump (fixes only 3 of 9 findings — eslint-plugin-import/react/jsx-a11y still pin minimatch ^3.1.2 at latest), no hand-rolled flat config (would drop the react/jsx-a11y/import rule sets). The 1.x line has received maintenance releases before (1.1.13–1.1.16), so a backport is plausible.

Why a watcher is needed: GitHub auto-dismissed the Dependabot alert for GHSA-mh99-v99m-4gvg (dev-scoped), so no security-update PR will be opened when a fix ships, and Dependabot version updates don't touch lockfile-only transitive deps. Nothing announces the fix. A weekly scheduled workflow (audit-watch.yml) runs full-tree npm audit --audit-level=high and comments here when it goes clean.

Revert steps once the watcher fires:

1. npm update brace-expansion (lockfile-only)
2. Remove --omit=dev from both audit invocations in the Makefile; drop the advisory comment above the audit target
3. Delete .github/workflows/audit-watch.yml and the audit-full Makefile target
4. Verify with make verify (full-tree audit is the gate again), close this issue