fix(deps): upgrade audited CSS transitive packages and run npm on Windows

[SHAURYAKSHARMA24]

Summary

Pin postcss-selector-parser 7.1.6 and source-map-js 1.2.2 in both app locks, matching GitHub first-patched advisory data. Windows invokes fixed npm audit arguments through cmd.exe; POSIX execFileSync remains unchanged. No audit policy/exception changes.

Linked issue

Related to #520.

Scope

Audit F5; baseline dev df0e82be3d7b2b7d846eefc1bcf82bde834936f2. This corrects independently verified existing behavior and advances the linked issue without adding product scope.

What changed

Pin postcss-selector-parser 7.1.6 and source-map-js 1.2.2 in both app locks, matching GitHub first-patched advisory data. Windows invokes fixed npm audit arguments through cmd.exe; POSIX execFileSync remains unchanged. No audit policy/exception changes.

Acceptance criteria completed

Implementation and targeted regression coverage below. See remaining work for conditions not verified.

Testing performed

Both clean npm installs, 9 audit-policy tests, live policy (0 blocking, 3 accepted), marketing runtime audit (0), frontend 480 tests/74 files with coverage, frontend/marketing lint/typecheck/build passed. Current-head repository engineering CI including browser acceptance and Docker startup succeeds; Vercel authorization fails.

Current head: f43d1135b732fe0ff63a10e053582b1e99e150cc; check snapshot appears below.

Screenshots

Local screenshots and browser measurements are recorded in the remediation delivery report where applicable. Backend-only changes use contract/regression evidence.

Security and data considerations

Preserves owner scoping, source provenance, sealed graph contracts and historical data. No security gate weakened. Rollback: revert this scoped commit; see issue for migration/deployment implications.

Dependencies and blocked work

Independent dev-based PR unless explicitly stated in the issue. No unmerged changes included.

Scope changes or remaining work

Current-head CI/review required. Independent of #518/#519; their lock diffs may require ordinary rebase after either merges.

Please review @parthrohit22.

Contributor checklist

• Targets dev; dedicated fork branch from latest dev; issue claimed.

• Scope/evidence recorded; unrelated changes and secrets excluded.

• Targeted validation results reported accurately.

• Required current-head CI and maintainer review complete.

Current-head remediation validation

Head: f43d1135b732fe0ff63a10e053582b1e99e150cc.

Both clean npm installs, 9 audit-policy tests, live policy (0 blocking, 3 accepted), marketing runtime audit (0), frontend 480 tests/74 files with coverage, frontend/marketing lint/typecheck/build passed. Current-head repository engineering CI including browser acceptance and Docker startup succeeds; Vercel authorization fails.

Current-head CI/review required. Independent of #518/#519; their lock diffs may require ordinary rebase after either merges.

Checks at delivery: Repository Hygiene: SUCCESS; Analyze (javascript-typescript): SUCCESS; Analyze (python): SUCCESS; API Contract Drift: SUCCESS; Frontend: SUCCESS; Backend: SUCCESS; Docker Build: SUCCESS; Marketing Site: SUCCESS; Prototype Browser Acceptance: SUCCESS; Vercel: FAILURE; CodeQL: SUCCESS. Required checks/reviews must pass before merge; deployment authorization was not granted.

[vercel]

@SHAURYAKSHARMA24 is attempting to deploy a commit to the parthrohit60-3117's projects Team on Vercel.

A member of the Team first needs to authorize it.