fix(ci): refresh bundled npm and extend content validation time

.github/workflows/check.yml

@@ -15,7 +15,8 @@ jobs:
   content-validation:
     name: Content validation
     runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    # Full-history/LFS checkout, corpus validation, and cleanup share this budget.
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

CONTRIBUTING.md

@@ -25,3 +25,13 @@ Use the Node.js version in the release workflow when changing this tooling, and
 run `node scripts/release/test-release-policy.cjs` and
 `node scripts/release/test-release-safety.cjs` to check release behavior. Preserve
 the ordinary npm lockfile so dependency review and Dependabot can inspect updates.
+
+The release toolchain includes npm's bundled dependencies. The npm 11.21.1
+lock update fixes the bundled `postcss-selector-parser` finding, but its
+`undici` 6.29.0 and `minimatch` 10.2.5 remain affected by
+[Undici advisories](https://github.com/advisories/GHSA-2m5v-pch6-74hx) and
+[the minimatch advisory](https://github.com/advisories/GHSA-g3hv-75wg-m249).
+Track a compatible npm parent release containing Undici 6.29.1 or later and
+minimatch 11.0.1 or later; npm 12.2.1 still bundles the same affected versions.
+Do not treat this partial update as resolving those findings or force a
+minimatch major override across npm's declared consumer ranges.