fix(ci): keep mutable advisory audits out of pre-merge gates

[sylphx-desk-studio]

What

Extend the existing workflow-lint non-deterministic-gate check to reject direct Bun, npm, pnpm and Yarn vulnerability audits in pull-request, merge-group and reusable workflows. Keep its delivered-customer exemption and secret-scanning behavior. Document launch-time audit ownership and advisory-driven updates through the existing bot.

Why

An advisory database changes independently of source. A newly published advisory can fail an unchanged PR while the previous main check stays green; every unrelated author then repairs the same dependency. Advisory maintenance belongs to a separate default-branch workflow for launched products, not the pre-merge gate. Unlaunched products defer audits to the final launch review rather than adding daily security work.

Puzzled adopts this guard in a companion workflow change that removes its PR audit while retaining the required Security Scan job and verified-secret detection. Its action pin is this exact shared head, so its queue entry is created only after this head has been pushed.

How tested

• Added regression cases for all four pre-merge triggers, Bun/npm/pnpm/Yarn command forms, mixed triggers, allowed scheduled-only audits, comments/step names, secret scanning and delivered-customer skips.
• git diff origin/main HEAD --check passed.
• Remote test execution was attempted but exited before running: the Build CLI has no org/project/env context for this repository checkout. No local test run is claimed.
• Required CI must run python -m unittest discover -s tests, the existing shared workflow-lint consumer invocation and workflow parsing. The companion Puzzled CI invocation proves the new action pin in an actual consumer.

No runtime, schema, dependency version or production state is changed. Rollback is reverting the shared rule and the consumer workflow/pin changes. Indirect package scripts are outside the static guard and are explicitly documented.

[sylphx-desk-services]

The YAML-node scanner covers decoded command scalars and conservative job-level exclusions, with regression matrices for the previously missed forms. The fixture-only repair preserves the consumer action bytes. The unit suite and shared-action invocation succeeded at this head; no blocking defects found.