upgrade: @intentius/* ^0.44.1 -> ^0.54.1; hosted parity for SEC/WRG/NGX (#25)

[lex00]

The bump

All eleven @intentius/* ranges move in lockstep ^0.44.1 → ^0.54.1, plus @cloudflare/workers-types ^4 → ^5 (wrangler 4.128's peer range; tsc --noEmit clean).

It took a release train to get here — the bump surfaced two real chant regressions and drove their fixes upstream:

• chant#2055 — 0.53.1 crashed workerd at startup (__filename is not defined): WHM503 statically reached the TypeScript compiler through the @intentius/chant barrel. Fixed by a light render-records module + a new edge-init-safety guard banning barrel imports from edge-reachable modules.
• chant#2056 — the new NGX family (chant#1979) was unreachable: isCandidatePath never admitted a .conf, so no nginx file survived collection on any path. Found by this repo's fixture producing zero NGX findings; fixed in 0.54.1.

Hosted parity

The handler now runs the lexicon-independent families the CLI always ran, beside the lexicon checks: scanForSecrets (SEC*), auditWranglerConfigs (WRG*), and auditNginxConfigs (NGX*, new in 0.54) — all pure/edge-safe. The fixture gains nginx/default.conf (directory listing on) and the e2e asserts the NGX family fires end to end.

Verification

tsc clean, 27 unit tests green, bundle 2.03 MiB gzip (gate: warn > 2.3), and a full fixture audit on workerd (wrangler dev --local): 18 findings including NGX003 on nginx/default.conf, no boot errors.

Closes #25

🤖 Generated with Claude Code

[lex00]

Two follow-up commits since the PR opened, both from CI dogfooding this very bump:

• dogfood-audit red → chant#2057 (shipped in 0.54.2, now the pinned range): the secrets scan read every lockfile integrity hash as a merge-worthy SEC010 — 438 findings on web/package-lock.json alone. Lockfiles are skipped upstream now; local npx chant audit . --fail-on merge-worthy is back to green (1 report-only GHA026).
• e2e-docker red → the 0.44-era pin "fountain audited as k8s" broke exactly as its own comment predicted: chant 0.54 routes fountain natively, and the clean fixture manifest produced no finding to assert on. Root cause on the hosted side was deeper: core's default entitiesProvider isn't edge-safe, so entity-reading FTN checks silently no-opped on the worker while firing in the CLI — the handler now mirrors it statically like CHECKS, and the fixture Environment carries a credential-shaped env var so FTN012 pins the native route positively.

Local verification at 0.54.2: tsc clean, 27 unit tests, bundle 2.03 MiB gzip, full fixture e2e PASS on workerd (FTN + NGX both firing), dogfood audit exit 0.