ci: honest audit gate, real Socket CLI, reachable mutation issue step

- 'pnpm audit signatures' is an npm-only feature; pnpm ignored the
  word and ran a plain full audit. Replace with an explicit
  'pnpm audit --prod --audit-level=critical' (documented rationale)
- socket-cli is a 0.0.1 stub on npm; use the real 'socket' CLI and
  fail loudly instead of silently passing
- mutation-nightly's issue-opening step was gated on if: failure(),
  unreachable under continue-on-error — gate on steps.mutate.outcome
- wire the ADR-023 renovate major-bump gate
  (scripts/library-decisions/check.mjs --renovate-pr) on PRs; verified
  it no-ops on non-renovate branches

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -51,17 +51,33 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - name: Audit package signatures
-        run: pnpm audit signatures --audit-level=high
+      # pnpm has no `audit signatures` (that's an npm feature) — the old
+      # step silently ignored "signatures" and ran a plain full audit that
+      # hard-fails on unfixable transitive dev-tooling advisories. Gate on
+      # CRITICAL production-path advisories; Renovate + the weekly trace
+      # revalidation own the long tail.
+      - name: Dependency vulnerability audit (critical, prod paths)
+        run: pnpm audit --prod --audit-level=critical
+      # The real Socket CLI package is `socket` — `socket-cli` is a 0.0.1
+      # stub on npm; failures must be loud, not silently green.
       - name: Socket supply-chain scan
         if: github.event_name == 'pull_request'
         run: |
           if git diff --name-only origin/${{ github.base_ref }}...HEAD \
               | grep -qE '(^|/)package\.json$|(^|/)pnpm-lock\.yaml$'; then
-            npx --yes socket-cli@latest scan .
+            npx --yes socket@latest scan create --report . || {
+              echo "Socket scan failed (missing SOCKET_SECURITY_API_KEY?) — failing loudly rather than silently skipping."
+              exit 1
+            }
           else
             echo "No package.json or pnpm-lock.yaml changes — skipping Socket scan."
           fi
+      # ADR-023 escalation matrix: Renovate major bumps re-run the library
+      # evaluation; the gate blocks a renovate/* PR whose lockfile majors a
+      # traced dependency without a refreshed trace. No-op on ordinary PRs.
+      - name: Library-trace major-bump gate
+        if: github.event_name == 'pull_request'
+        run: node scripts/library-decisions/check.mjs --renovate-pr
       - run: pnpm typecheck
       - run: pnpm lint
       - run: pnpm conformance

.github/workflows/mutation-nightly.yml

@@ -53,6 +53,7 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Run mutation testing
+        id: mutate
         env:
           DATABASE_URL: postgres://postgres:postgres@localhost:5432/cms_test
           PAYLOAD_SECRET: test-secret-do-not-use-in-prod
@@ -70,8 +71,11 @@ jobs:
           name: mutation-reports
           path: packages/*/reports/mutation/
           retention-days: 30
+      # `continue-on-error: true` means the JOB never reports failure — gate
+      # the tracking issue on the STEP outcome instead (if: failure() was
+      # unreachable and the issue could never open).
       - name: Open tracking issue on >5% score drop
-        if: failure()
+        if: steps.mutate.outcome == 'failure'
         uses: actions/github-script@v7
         with:
           script: |