ci: honest audit gate, real Socket CLI, reachable mutation issue step

- 'pnpm audit signatures' is an npm-only feature; pnpm ignored the
  word and ran a plain full audit. Replace with an explicit
  'pnpm audit --prod --audit-level=critical' (documented rationale)
- socket-cli is a 0.0.1 stub on npm; use the real 'socket' CLI and
  fail loudly instead of silently passing
- mutation-nightly's issue-opening step was gated on if: failure(),
  unreachable under continue-on-error — gate on steps.mutate.outcome
- wire the ADR-023 renovate major-bump gate
  (scripts/library-decisions/check.mjs --renovate-pr) on PRs; verified
  it no-ops on non-renovate branches

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -51,17 +51,33 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - name: Audit package signatures
-        run: pnpm audit signatures --audit-level=high
+      # pnpm has no `audit signatures` (that's an npm feature) — the old
+      # step silently ignored "signatures" and ran a plain full audit that
+      # hard-fails on unfixable transitive dev-tooling advisories. Gate on
+      # CRITICAL production-path advisories; Renovate + the weekly trace
+      # revalidation own the long tail.
+      - name: Dependency vulnerability audit (critical, prod paths)
+        run: pnpm audit --prod --audit-level=critical
+      # The real Socket CLI package is `socket` — `socket-cli` is a 0.0.1
+      # stub on npm; failures must be loud, not silently green.
       - name: Socket supply-chain scan
         if: github.event_name == 'pull_request'
         run: |
           if git diff --name-only origin/${{ github.base_ref }}...HEAD \
               | grep -qE '(^|/)package\.json$|(^|/)pnpm-lock\.yaml$'; then
-            npx --yes socket-cli@latest scan .
+            npx --yes socket@latest scan create --report . || {
+              echo "Socket scan failed (missing SOCKET_SECURITY_API_KEY?) — failing loudly rather than silently skipping."
+              exit 1
+            }
           else
             echo "No package.json or pnpm-lock.yaml changes — skipping Socket scan."
           fi
+      # ADR-023 escalation matrix: Renovate major bumps re-run the library
+      # evaluation; the gate blocks a renovate/* PR whose lockfile majors a
+      # traced dependency without a refreshed trace. No-op on ordinary PRs.
+      - name: Library-trace major-bump gate
+        if: github.event_name == 'pull_request'
+        run: node scripts/library-decisions/check.mjs --renovate-pr
       - run: pnpm typecheck
       - run: pnpm lint
       - run: pnpm conformance