🔒 Cover coordinated dependency axes

[IsaacInsoll]

Summary

• keep Playwright Test synchronized with its digest-pinned container, browser binaries, and snapshots
• keep Vite synchronized between the root and independent packed-consumer fixture
• give the packed consumer dedicated Dependabot security coverage and scheduled auditing while leaving routine updates manually coordinated
• apply a 30-day cooldown to GitHub Actions major updates
• record the explicit NODE_AUTH_TOKEN requirement for bootstrap or emergency token publishing under actions/setup-node v7

Context

This follows the first grouped Dependabot review. The compatibility policy in PR #19 covered React and TypeScript axes, but Playwright and Vite also have coordinated artifacts outside the root manifest. The packed consumer intentionally remains outside the root workspaces, so its lockfile now receives explicit security coverage without weakening the fresh-install test boundary.

The failure-only upload-artifact v7 step was not exercised by the green Actions update PR; its compatibility remains based on its documented hosted-runner requirements and release notes.

Verification

• npm run format:check
• npm run lint
• parsed Dependabot and security workflow YAML
• npm run security:audit (zero root and packed-consumer vulnerabilities)
• npm run typecheck
• npm run test:types
• npm test (3 files, 63 tests)
• npm run test:consumer
• npm run package:check
• git diff --check