fix(*): apply approved expiring publishing audit exceptions

[omermorad]

Scope

• Apply Omer's explicit 2026-10-08 approval for the two reviewed publishing-audit risk exceptions. This is preparation only, not approval to dispatch publication, tag, publish packages, or create releases.
• Change only the audit step in the existing publish-packages.yml; use the same native inline audit logic and fixed expiry as CI.
• No package versions, source code, dependencies, scripts, custom actions, test files, or other workflows change.

Exact exceptions and expiry

Both exceptions expire at 2026-10-22 05:37:00 UTC, with no extension:

• GHSA-vfj7-8cjw-p6xm: only braces@3.0.3. The merged CLI glob size/depth guards mitigate the reviewed input path; tooling consumers remain affected.
• GHSA-ch52-4w7c-c8xp: only http-cache-semantics@4.2.0 through the reviewed root lerna@9.0.7 dependency paths. Reviewed callers use private caches on fresh runners; this does not authorize shared-cache usage.

Every other advisory remains blocking regardless of severity. Registry errors, unexpected statuses, invalid reports, muted findings, missing dependency paths, and inconsistent counts fail closed. At expiry, either remaining advisory blocks again; a clean report still passes. Accepted risks remain visible in warnings and the job summary. Remove the exceptions when patches are available; no security alert is dismissed.

Preserved release safeguards

• Manual dispatch on next, the release environment approval, and exact approved-commit verification remain unchanged.
• Beta-only package metadata, immutable-tag checks, registry ownership/commit checks, and the beta dist-tag remain unchanged.
• A structural comparison confirmed that replacing the new audit step with the original single-line audit reproduces the previous workflow exactly.
• Contractual only: this does not change contractual-action's release audit.

Validation

• Frozen install, build, lint: passed.
• Existing unit tests: 8 passed.
• Existing E2E suite: 358 passed, 1 existing skip.
• Actionlint and whitespace checks: passed.
• Audit logic/expiry parity with CI and unchanged release safeguards: passed.
• Only the read-only audit step was executed locally against the live registry; 19 ephemeral expiry/failure probes passed. No new test files were added.

The separately approved Codecov allowlist correction is applied directly in repository settings, adding only its exact actions/github-script dependency. Coverage rerun is green.

Nothing has been merged, tagged, or published by this work. No release workflow has been dispatched.