fix(utils): drop the Node crypto import, and tighten what the package ships

.github/workflows/publish.yml

@@ -69,8 +69,23 @@ jobs:
       - name: Clean up ready for publishing
         run: npm run publishInit
 
+      - name: Audit the release toolchain
+        # Its own scope: the toolchain is not shipped, so it must not gate the
+        # package, but it runs with publish credentials, so it must not be
+        # invisible either. Fails on anything outside the named exemptions in
+        # release/audit.mjs.
+        run: node release/audit.mjs
+
+      - name: Install the release tooling
+        # Its own locked tree, installed here rather than carried as a
+        # devDependency: that tree is where the unfixable advisories live, so
+        # keeping it out of the package's dependencies keeps it out of the
+        # package's `npm audit`. Locked, so the resolved versions and their
+        # integrity hashes are pinned rather than fetched fresh at release time.
+        run: npm ci --prefix release --ignore-scripts
+
       - name: Semantic Release
-        run: npx semantic-release
+        run: release/node_modules/.bin/semantic-release
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}   # <-- app token, not secrets.GITHUB_TOKEN
 

.github/workflows/run-tests.yml

@@ -30,6 +30,13 @@ jobs:
       - name: Check npm audit
         run: npm audit --production --audit-level=low
 
+      - name: Audit the release toolchain
+        # Its own scope: the toolchain is not shipped, so it must not gate the
+        # package, but it runs with publish credentials, so it must not be
+        # invisible either. Fails on anything outside the named exemptions in
+        # release/audit.mjs.
+        run: node release/audit.mjs
+
       - name: Install Dependencies
         run: npm ci