security: distinguish forward deepmerge remediation

[azumag]

Summary

• extend the Security: Prisma → deepmerge-ts 暫定audit例外を upstream 修正後に削除する #3114 read-only audit status helper with a fail-closed forward-remediation-candidate state
• classify that state only when both the installed deepmerge-ts version and the @prisma/config dependency edge move to the patched >=8.0.0 line
• deliberately keep consumer-side overrides as generic context-changed so a forced transitive major does not masquerade as an upstream fix
• add regression coverage for the patched boundary, prereleases, simple dependency ranges, and override-vs-forward-update behavior
• document the current upstream state: chore(deps): bump deepmerge-ts and mariadb past audited vulnerabilities prisma/orm#30189 is merged to v7, while stable 7.10.0 predates that merge

Safety

This does not change dependencies, the lockfile, the audit allowlist, severity gates, application behavior, database behavior, or deployment configuration. All non-active status states still exit non-zero. A remediation candidate still requires the canonical security audit and full CI before the temporary exception can be removed.

Tracks #3114.

[azumag]

コード・設計・テスト・CIを確認しました。blocking finding はありません。

• forward-remediation-candidate は generic lockfile/manifest precondition 通過後にのみ判定され、active 以外は引き続き non-zero exit のため security gate を緩めていません。
• installed deepmerge-ts >=8.0.0 だけでは候補扱いせず、@prisma/config 自身の dependency edge も patched line へ移った場合だけ分類するため、consumer-side major override と upstream forward fix を区別できています。
• prerelease/invalid/complex range は安全側へ倒し、既知比較可能な単純 range だけを扱う設計も妥当です。
• 初回CIの Prettier failure は同じPRで修正済み。最終HEAD 9003f432 では lint、changed-file formatting、unit tests、security audit、Prisma/D1 migration parity、Cloudflare Workers build gate、review workflow がすべて成功しています。

依存・lockfile・temporary allowlist・severity gate・アプリ挙動は変更していないため、#3114 を前進させる読み取り専用診断として merge 可と判断します。