fix(ci): unblock scopeweave central gates (coverage evidence, trivy-fs, Semgrep)

cloud-sync.js

@@ -740,6 +740,13 @@ function openReportModal() {
 // hand-edited files ever matter.
 export function parseMsProjectXml(xml) {
   const tag = (block, name) => {
+    // False positive for the non-literal RegExp SAST rule: `name` is only ever
+    // a hardcoded literal tag from this function ('UID', 'Name', 'OutlineLevel',
+    // 'PercentComplete', ...), never user input, so the constructed pattern is
+    // fixed. The `[^<]*` body is a single linear character-class star (no
+    // nested/overlapping quantifiers), so it cannot backtrack catastrophically
+    // even on adversarial `block` input — no ReDoS or regex-injection surface.
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
     const m = block.match(new RegExp(`<${name}>([^<]*)</${name}>`));
     return m ? m[1].trim() : '';
   };

package.json

@@ -17,7 +17,7 @@
     "fuzz": "node --test tests/fuzz/*.mjs"
   },
   "dependencies": {
-    "@hono/node-server": "^1.19.14",
+    "@hono/node-server": "^2.0.12",
     "hono": "^4.12.27"
   },
   "devDependencies": {