feat(security): Dependencies tab, ranked by what runs in production - #2045

🟢 Confidence 8/10 · likely safe to merge. Held at 8 because 2 fixes have not been re-checked against the whole diff yet.
_{no findings · tests covered · risk medium · 2 fixes not yet re-checked against the whole diff}

The last two fixes land: the sheet dates "Last seen" by the commit, not the triage-rewritten updatedAt, and the reason field checks the reason trimmed as triage sends it. Both are pinned by scene tests. The McpQueryError issues are unrelated to this change and untouched: registry.ts only registers the new page.

• findingSheet reads "Last seen" from lastSeenSha, never updatedAt
• reasonField validates model.reason.value.trim() like triage writes it
• Scene tests pin both: triaged updatedAt is absent, a 501-char reason is written trimmed

Fixed since the last review

• ✅ F15 · Last seen in the sheet shows updatedAt, which triage rewrites
• ✅ F16 · reasonField errors on a reason that triage trims and writes

Production impact

_{d38dbf9 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}