fix: harden release verification and resume accessibility

[BrickerP]

Closes the remaining root-site release and accessibility gaps.

Key changes:

• restores byte-identical known-good Vite 6.4.3 after Vite 8.1.5 reproducibly changed 10 macOS Chrome seam channels at 0s/48s
• adds a hosted macOS Chrome seam lane to the stable Quality gate
• makes workflow reruns safe with run-attempt artifact names and immutable artifact-id handoff to all five consumers
• adds dependency review, SECURITY.md, and bounded post-deploy 23-file byte-parity verification
• publishes the shared tagged resume with language, semantic headings/lists, 11 structured links, bookmarks, Unicode maps, and active-content rejection

Local evidence:

• npm audit: 0 vulnerabilities
• source/type/geometry/build/bundle/dist/browser gates: pass
• 48-second recorder: pass
• macOS Chrome seam: 2,304,000 channels, 0 differences, maxDelta 0
• local post-deploy simulation: 23/23 files byte-identical
• resume render and extracted text: byte-identical to prior visual revision
• independent code review: APPROVE

The resume accessibility gate is an artifact contract, not a PDF/UA certification; inherited Helvetica fonts remain unembedded.