gandalf-the-greybeard[bot]
991278ebac
Adds a security audit step (npm audit --omit=dev) to catch known vulnerabilities in production dependencies. Runs after tests so build failures are reported before audit findings. Uses --omit=dev to focus on production-facing risk. This covers all 6 plugin repos that use the shared workflow.