Start worldwide audit roadmap and ship the corrective foundation (#9)

* docs: turn the end-to-end audit into a delivery roadmap

* fix: deliver roadmap security and data-correctness foundation

* fix: type saved paint properties for the MapLibre 6 API

* build: account explicitly for the MapLibre 6 worker cost

* docs: record the paired foundation delivery and measured worker cost

* style: remove trailing blank line from sanitizer regression

* ci: expose exact-commit manual validation to pull requests

.github/workflows/ci.yml

@@ -40,6 +40,9 @@ jobs:
           cache-dependency-path: web/package-lock.json
       - working-directory: web
         run: npm ci
+      - name: Audit shipped frontend dependencies
+        working-directory: web
+        run: npm audit --omit=dev --audit-level=high
       - working-directory: web
         run: npm test
       - working-directory: web
@@ -161,9 +164,29 @@ jobs:
     if: always()
     needs: [backend, frontend, container]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      statuses: write
     steps:
-      - env:
+      - name: Require every validation job
+        id: gate
+        env:
           BACKEND: ${{ needs.backend.result }}
           FRONTEND: ${{ needs.frontend.result }}
           CONTAINER: ${{ needs.container.result }}
         run: test "$BACKEND" = success -a "$FRONTEND" = success -a "$CONTAINER" = success
+      - name: Attach dispatched validation to the exact commit
+        if: always()
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GATE_RESULT: ${{ steps.gate.outcome }}
+        run: |
+          state=failure
+          if [ "$GATE_RESULT" = success ]; then
+            state=success
+          fi
+          gh api --method POST "repos/$GITHUB_REPOSITORY/statuses/$GITHUB_SHA" \
+            -f state="$state" -f context='CI / Required' \
+            -f description='Maintainer-dispatched backend, frontend and container validation' \
+            -f target_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+            --silent