Fix resolved Alpha advisory baseline

[DanielJD1216]

Summary

• require the current production dependency audit to contain exactly zero vulnerabilities across both security gates and Story 3 conformance
• record the prior nested MCP advisory as resolved history on 2026-08-31
• replace the expired temporary-acceptance deadline gate with a resolved-disposition record gate
• update current Alpha security, setup, and readiness wording without changing runtime behavior or dependency pins

Why

The live npm advisory database no longer reports the prior two moderate findings, but the repository security gates still required that obsolete advisory set. This caused package and PostgreSQL CI to fail before conformance.

Security behavior

• audit subprocess failure, malformed JSON, malformed vulnerability maps, contradictory counts, and any non-empty production vulnerability set fail closed
• the exact MCP SDK and direct Hono dependency pins remain unchanged
• the published npm registry artifact and package metadata remain unchanged as immutable historical evidence; latest-source package documentation labels release-time acceptance as historical
• prior advisory identity and owner-accepted history remain documented in repository-level records
• Windows, HTTP/SSE MCP, static serving, hosting, deployment, production, real data, and live providers remain blocked
• no Alpha runtime behavior source under apps/alpha1-runtime/src, MCP profiles, migrations, package lock, publication, release, or deployment state changes

Validation

• npm audit --omit=dev --json reports zero vulnerabilities
• explicit audit subprocess matrix: exact clean {} passes; false, array, missing, non-empty, nonzero counts, malformed JSON, and clean JSON with nonzero exit all fail in both gates
• npm run local-runtime:security-gate
• npm run alpha1:story5:security-gate
• hosted PostgreSQL 18.4 and 16 Story 3 conformance must pass the same zero-advisory assertion
• npm run story5:release-candidate-smoke
• direct Gate B self-test and scope enforcement
• npm run local-runtime:candidate-smoke
• npm test
• npm run alpha1:test
• npm run docs:links
• npm run docs:anchors
• npm run safety:scan
• npm run claims:scan
• npm run readiness:report
• npm run publish:readiness
• git diff --check

All listed local gates passed. Hosted PostgreSQL 18.4 and 16 conformance will run in CI with exact Node 22.23.1.

Closes #300