ci(release): bind current authorized production audit bodies

[wybaby168]

Summary

• Bind the 16 frozen production audit cases to the currently reviewed request digests. All 268 package names are unchanged; five dependency resolutions changed from the earlier frozen authorization record.
• Preserve the exact request-body, official npm endpoint, credential-header and no-fallback guards. Thresholds and the existing Vue 2 compatibility exception are unchanged.
• Keep the same 89 archives, source bindings, candidate tag and npm manifest. The current user-provided maintenance instructions explicitly authorize package-name/version audit metadata; raw scope reviews, locks and private reports remain local.

Related issue

N/A: release qualification control data for the already merged 3.2.2 source in #387.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Check	Result
node --test .github/scripts/runtime-ci-artifacts.test.mjs	Passed
node .github/scripts/runtime-ci-security.mjs <reviewed-root> <frozen-inputs>	Passed: all 16 exact request bodies through the unchanged normal npm audit path; four retain the existing low Vue 2 host exception
git diff --exit-code 3692fc2f6d61474aa862164de7a1f9ce375eb87d origin/main	Passed: protected rebase merge retained the exact reviewed complete source tree

The earlier candidate CI independently passed all 16 framework/profile consumers in Chromium and WebKit before the old audit digest rejected changed resolution metadata. Those consumer archives and the npm manifest are unchanged. No private expanded workspace inventory was read or sent.

Sample / fixture evidence

N/A: only 16 opaque approval digests changed; the existing frozen public runtime cohort remains byte-identical.

Visual evidence

N/A: no user interface, rendering code or runtime archive changed.

Risk and compatibility

• Affected packages/formats: production security qualification of the same 16 public framework/profile cases.
• Compatibility or migration risk: no package, dependency declaration or artifact changed; unknown future request-body drift still stops before submission.
• Rollback: the previous digest values remain in Git history and the original candidate tag; restoring them blocks newer resolution bodies until reviewed again.

Checklist

• I added or updated focused automated coverage, or explained why it is not needed.
• I updated user-facing documentation or release notes when behavior or API changed, or marked them not applicable.
• I verified offline/private-deployment paths when changing Worker, WASM, fonts, vendor assets, or URLs.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.