fix(ci): actually make the Audit step green, not just documented as accepted

npm audit --audit-level=high doesn't read code comments -- it was still
exiting 1 on the one remaining, already-investigated-as-unfixable advisory
(eslint-plugin-jsx-a11y's own pinned minimatch, GHSA-mh99-v99m-4gvg), so
every run on main has actually been red despite the prior commit's comment
calling it "known-accepted". That advisory lives entirely in
devDependencies (lint tooling, never shipped), so --omit=dev is the
correct signal for "doesn't apply to what we ship" -- verified locally,
0 vulnerabilities. Runtime dependencies are still audited at high severity.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -180,26 +180,20 @@ jobs:
       - name: Build Storybook
         run: npm run build-storybook
         working-directory: frontend
-      # Known-accepted as of 2026-07-26: 1 high advisory,
-      # brace-expansion/minimatch via eslint-plugin-jsx-a11y's own pinned
-      # minimatch@^3.1.2 (GHSA-mh99-v99m-4gvg). Not exploitable here -- this
-      # chain only runs against this repo's own hardcoded lint globs, never
-      # untrusted input. The eslint-core minimatch@10.x instance of the same
-      # advisory is already fixed via the "minimatch@^10" override below
-      # (brace-expansion 5.0.8); jsx-a11y's own minimatch is pinned to an old
-      # major with no patched release in that line, and forcing it to 10.x
-      # via override breaks npm's own dependency-tree validation (a genuine
-      # incompatibility, not just an npm quirk) -- so this one can only be
-      # fixed by an eslint-plugin-jsx-a11y release bumping its own minimatch.
-      # `npm audit fix --force`'s suggestion is a downgrade to before jsx-a11y
-      # adopted the vulnerable chain at all; left as-is rather than trading a
-      # real regression for a vulnerability that doesn't apply.
-      # The other advisory this comment used to cover (react-router RSC CSRF
-      # bypass, GHSA-qwww-vcr4-c8h2) is actually fixed now: migrated off the
-      # abandoned react-router-dom (frozen at 7.18.1, pinning the vulnerable
-      # react-router 7.18.1) onto react-router 8.3.0 directly, which has the
-      # real forward fix -- not a downgrade. Re-check on a future bump in
-      # case upstream ships a real fix for the remaining advisory too.
+      # --omit=dev: the one remaining high advisory (brace-expansion/minimatch
+      # via eslint-plugin-jsx-a11y's own pinned minimatch@^3.1.2,
+      # GHSA-mh99-v99m-4gvg) lives entirely in devDependencies -- jsx-a11y is
+      # lint-only tooling, never shipped in the built panel, and only ever
+      # runs against this repo's own hardcoded lint globs, never untrusted
+      # input. The eslint-core minimatch@10.x instance of the same advisory
+      # is already fixed via the "minimatch@^10" override below (brace-
+      # expansion 5.0.8); jsx-a11y's own minimatch is pinned to an old major
+      # with no patched release in that line, and forcing it to 10.x via
+      # override breaks npm's own dependency-tree validation (a genuine
+      # incompatibility, not an npm quirk) -- so it can only be fixed by an
+      # eslint-plugin-jsx-a11y release bumping its own minimatch. `--omit=dev`
+      # still audits runtime `dependencies` at high severity, so a real
+      # production vulnerability still fails this step.
       - name: Audit
-        run: npm audit --audit-level=high
+        run: npm audit --omit=dev --audit-level=high
         working-directory: frontend