Run the dependency audit as an advisory CI step

The decision

Add `npm audit` to the verify workflow with `|| true`, so a known vulnerability in a transitive dependency is visible without blocking unrelated work.

Why, at the time

Blocking every pull request on a third-party advisory we cannot fix teaches people to ignore the pipeline.

What happened

The step talks to the registry and hung twice in a row, taking the whole job to its fifteen-minute timeout. Two runs reported as cancelled even though lint, type-checking, the tests and the production build had all passed — and both commits were already live. Fixed with a two-minute timeout on the step.

Lesson

`|| true` guards against a non-zero exit, which was not the failure mode. An advisory step needs a timeout, or it is not advisory.

Every entry in this ledger is real and was checked against the commit or migration that carries it. Want to keep your own this way? Start with the free decision log template.