[aiden0rchad]

CI audits reject the locked Vite and source-map-js versions and report reachable standard-library vulnerabilities in the pinned Go toolchain. Update UI Vite 7.3.6 → 7.3.7, documentation Vite 6.4.3 → 6.4.4, and both source-map-js locks 1.2.1 → 1.2.2, preserving the existing Vite major versions.

Pin Go 1.26.10 for CI and releases, update the digest-pinned container builder, and align the toolchain documentation, CA-bundle provenance, generated licenses, and release contract checks. The new image contains ca-certificates-bundle 20260909-r0; its package metadata and source archive were verified. Make the existing scan-error test wait for the asynchronous focus effect, retaining the focus assertion that failed in CI.

Related to the audit failures on #46. Advisories: source-map-js, Vite, Vite, Vite, Go, Go patch releases.

Validation:

• Both OSV lockfile audits pass; Go 1.26.10 govulncheck reports no reachable vulnerabilities.
• 563 UI unit tests and 58 Playwright browser tests passed locally.
• UI production/demo builds, bundle budget, and documentation build passed, including 9 screenshot-validator tests.
• Full Go test suite, module verification/tidiness, release contract tests, generated-license check, embedded-UI check, secret scan, and git diff check passed locally.
• Full GitHub CI and documentation CI pass on bee3e6d, including the full race suite, reproducible release archives, container backup/restore, and multi-platform image build.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.