security: remove internal registry and non-synthetic chat evidence

[PeterGuy326]

Security findings

• The public lockfile resolves dependencies through an enterprise-internal npm registry, exposing internal infrastructure and breaking external reproducibility.
• The public blog source contains copies of three non-synthetic DingTalk conversation captures and embeds them in an article.
• The dependency lock currently resolves packages with high/moderate advisories that are fixable within the existing ranges.

Required remediation

• Rewrite all lockfile resolutions to the public npm registry and verify a clean install.
• Remove the three conversation binaries and every embed while retaining only privacy-bounded text summaries.
• Refresh the lockfile with the package manager's audit fix and verify zero high findings.
• Do not reproduce private conversation content or credential-bearing values in commits, PR text, fixtures, or logs.

Historical copies require separately authorized history rewriting and cache/clone coordination.

[PeterGuy326]

Security remediation update (2026-08-27):

• the public default branch was rebuilt as a single clean root commit;
• three stale feature branches with no open PR were deleted;
• a fresh remote clone found neither the removed evidence images nor the internal registry domain in writable refs;
• nine GitHub read-only PR refs still retain the old object graph, so a GitHub Support dereference/GC request is prepared.

The current Pages content was already rebuilt and deployed from the sanitized tree. This issue stays open until GitHub Support confirms cached-view and PR-ref cleanup.