ci: harden delivery and OpenSearch contract gates

[afoote-mitre]

Stack

4 of 6 in the 0.4.0 review stack.

• Base: af/0.4.0-review-03-validation
• Previous: #124
• Next: #126

Why These Changes Are Needed

The hardened application behavior needs enforceable delivery gates and a read-only way to detect drift between query assumptions and the deployed OpenSearch mapping. Dependency and generated lockfile changes are isolated in this range so reviewers can evaluate supply-chain policy separately from later runtime safeguards.

Review Size

Changed lines are additions plus deletions in this PR's adjacent diff. Generated files are package-lock.json and api-docs/openapi.json; tests are *.test.js and files under test/.

Category	Changed Lines
Total	3,806
Generated files	2,888
Tests	704
Non-generated, non-test	214

Change-to-File Map

Change	Why It Is Needed	Primary Implementation Files	Test / Contract Coverage
Refresh dependencies and security overrides	Remove unused direct packages and resolve known fixable transitive findings before enforcing the image gate, including brace-expansion 5.0.9.	package.json, generated package-lock.json	test/delivery-policy.test.js, GitHub dependency/container checks
Add dependency update policy	Route npm, Docker, and GitHub Actions updates through the dev integration branch on a controlled schedule.	.github/dependabot.yml	test/delivery-policy.test.js, Dependabot configuration check
Enforce repository and image quality gates	Run quality, dependency review, production-image validation, and two-pass Trivy reporting/enforcement with pinned actions.	.github/workflows/quality.yml, .trivyignore, Dockerfile, Dockerfile.local	test/delivery-policy.test.js, GitHub Actions jobs
Add protected OpenSearch contract execution	Detect mapping, source-projection, query, and response drift without writing to the deployed index or broadly exposing secrets.	.github/workflows/opensearch-contract.yml, test/contract/opensearch.js, utils/searchProvider.js	test/contract/opensearch.test.js, utils/searchProvider.test.js
Bound the transitive exception	Record ownership and a review deadline for the adm-zip advisory inherited from cve-core.	.trivyignore, package.json	test/delivery-policy.test.js
Align delivery/API documentation	Document contract execution and keep generated API content synchronized after dependency/runtime changes.	README.md, routes/swagger.js, generated api-docs/openapi.json	api-docs/openapi.test.js

Reviewer Focus

• Review package.json before the generated lockfile.
• Confirm all workflow actions are pinned and permissions/secrets are narrowly scoped.
• Confirm every OpenSearch contract operation is read-only.
• Confirm the Trivy exception owner, fixed version, and review-by date are acceptable.