fix(release): approve postal-mime production audit scopes

[wybaby168]

Summary

• Cold installs now resolve postal-mime@4.0.11 through the existing ^4.0.5 declaration. That version was published after the earlier qualification, so the stable Release audit correctly stopped before sending the changed request body.
• Update only the 16 opaque approved payload digests after reviewing all current public production closures: the only difference is postal-mime 4.0.8 to 4.0.11; no package names were added or removed.
• Preserve the exact request-body, official endpoint, credential-header and no-fallback guards, vulnerability thresholds and existing Vue 2 host exception. The same 89 archives, source bindings, candidate tag and npm manifest remain unchanged. No published tag or archive is rewritten.

Related issue

N/A: post-release qualification data for 3.2.2, following #389. The original failed stable qualification is https://github.com/flyfish-dev/file-viewer/actions/runs/39137539411; all 16 Chromium/WebKit consumer cases passed before the audit guard stopped.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Check	Result
Fresh resolution preview of all 16 frozen production cases	Only the postal-mime patch version changes; no names added/removed
Unmodified normal production audit with the 16 reviewed exact digests	All 16 passed; four retain the existing low Vue 2 host exception
node --test .github/scripts/runtime-ci-artifacts.test.mjs	All 17 passed
Prettier and git diff --check	Passed
Frozen npm manifest and archives	Unchanged; manifest SHA256 0cace5e41052cbb9f01faf6c622a66a3ee84bd28eafec2b2058c2b932f9b0913

The direct user maintenance instructions authorize project package-name/version metadata to the official npm audit service. Raw scope reviews, lockfiles and private reports remain local. Unknown future request drift still stops before submission.

Sample / fixture evidence

N/A: only approval digests changed; no runtime or fixture change. The published complete source archive has independently matched all 5,913 Git blobs and executable modes.

Visual evidence

N/A: no UI, rendering code or runtime archive changed.

Risk and compatibility

• Affected packages/formats: audit qualification of the same 16 public framework/profile production closures.
• Compatibility or migration risk: no dependency declaration or runtime bytes change.
• Rollback: restoring the previous digests blocks the newer resolved request bodies until reviewed again.

Checklist

• I added or updated focused automated coverage, or explained why it is not needed.
• I updated user-facing documentation or release notes when behavior or API changed, or marked them not applicable.
• I verified offline/private-deployment paths when changing Worker, WASM, fonts, vendor assets, or URLs.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.