fix: upgrade dependencies and harden installation paths

[decofe]

The docs toolchain currently has six npm audit findings, including vulnerable Vite, esbuild, PostCSS, Rollup, and nanoid dependencies. Upgrade VitePress from 1.6.4 to 2.0.0-alpha.20 and refresh its lockfile to remove all six without overrides. This deliberately adopts a prerelease: VitePress 1.6.4 is still the latest stable release and cannot resolve the vulnerable Vite/esbuild chain through compatible upgrades.

Also address the supply-chain findings from the repository scan:

• Disable npm lifecycle scripts, require a seven-day release age, reject Git dependencies, and use Node 24 in docs CI.
• Lock Python analysis dependencies with hashes, retain editable requirements in analysis/requirements.in, and refuse source builds. Pin crytic-compile and Slither installs and apply a seven-day resolver cooldown.
• Verify Echidna, Medusa, Recon, binary Foundry, uv, and rustup downloads before execution; verify AWS CLI against its published signing-key fingerprint. Custom fuzzer versions now require a matching SHA-256 via the existing environment map.
• Upgrade public GitHub Actions to SHA-pinned releases older than seven days. The newer Pages upload action also fixes its previously unpinned nested upload-artifact action, which blocked the docs job at setup.
• Upgrade the actionlint job's Go toolchain from 1.22 to 1.27.1 and actionlint to 1.7.12; the existing actionlint dependency already requires Go 1.24 or newer.
• Pass benchmark values through environment variables instead of shell/JavaScript source interpolation, validate release path identifiers, replace inherited secrets with the five declared inputs, and remove the corresponding zizmor suppressions.
• Add grouped Dependabot updates for npm, Python, and GitHub Actions, with cooldowns and PR limits.

Validation: npm ci and the docs build pass with install scripts disabled; npm audit, OSV lockfile scanning, and pip-audit report no known vulnerabilities. All 135 Python tests pass, including modified-download and missing-checksum rejection. actionlint, shell syntax checks, and git diff --check pass. Zizmor reports only the existing low-severity self-repository syntax suggestion. Pinact passes with the shared org policy (seven days for public actions, the existing exemption for tempoxyz/gh-actions). All five GitHub release archives were downloaded and their pinned digests verified.

Operational limitations: EC2 provisioning and AWS deployments were not executed. The repository currently has no GitHub Environments; protecting secret-bearing jobs needs an administrator's environment/credential policy. Existing shared secure-runner actions remain first in all execution jobs, but may fall back to audit mode or skip Aegis when STS/setup fails; fork PRs do not receive Aegis credentials. This PR does not claim runtime enforcement from static configuration. No releases exist in this fork, so release immutability could not be verified. Terraform/provider versions and benchmark source refs retain their existing behavior.

GitHub validation on d20b587: CI, Dependency Scan, Scan GitHub Actions, and both Socket checks all passed.

Prompted by: @horsefacts

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​numpy@​2.5.3 ⏵ 2.4.6
	pypi/​scipy@​1.18.1 ⏵ 1.17.1
	pypi/​pillow@​12.3.0
	npm/​vitepress@​1.6.4 ⏵ 2.0.0-alpha.20	+1		+3	-1	-9
	pypi/​fonttools@​4.65.0
	pypi/​packaging@​26.3
	pypi/​python-dateutil@​2.9.0.post0
	pypi/​pyparsing@​3.3.2
	pypi/​six@​1.17.0
	pypi/​kiwisolver@​1.5.1
	pypi/​contourpy@​1.3.3
	pypi/​cycler@​0.12.1

View full report