docs: add new audit reports and LIP-37

[tamtamchik]

Please, go through these steps before you request a review:

📝 Describe your changes

1. Update audits page
2. Add LIP-37 to the LIPs page
3. Refactor external content fetch scripts and add a unified npm run fetch command
4. Move redirects to a shared config for imported Markdown links
5. Add tests for fetch scripts and redirects, and run them in build and deploy workflows

🔎 Attach a source of truth or evidence that allows reviewers to confirm the changes independently

1. https://github.com/lidofinance/audits
2. https://github.com/lidofinance/lido-improvement-proposals/blob/develop/LIPS/lip-37.md

[Copilot]

Pull request overview

Updates the generated security audits documentation to include new audit reports and adjusts generation logic to keep links/build checks stable, plus adds LIP-37 to the LIPs index.

Changes:

• Extend scripts/fetch-audits.js to rewrite docs.lido.fi links to local routes (including a renamed-page mapping) and skip the “Lido Earn” section (now maintained on earn/audits.md).
• Refresh docs/security/audits.md with new audit entries and updated per-section report counts.
• Add LIP-37 to the “Proposed” section in docs/lips.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
scripts/fetch-audits.js	Improves audits markdown preprocessing (PDF + docs links) and skips Earn audits section in the generated output.
docs/security/audits.md	Updates the audits page content with new reports, additional commit references, and adjusted counts.
docs/lips.md	Adds the new LIP-37 entry under Proposed LIPs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[arwer13]

LGTM.

Could add the new Direct Staking https://github.com/lidofinance/audits/tree/main/L2 audit reports here or a follow-up commit.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated no new comments.

Suppressed comments (4)

docs/security/audits.md:1385

• The second sentence is a fragment. Correct it in the audit source README and regenerate the page.

> NB: It is not authored by Lido. Used by Lido Direct Staking Automation contracts.

docs/security/audits.md:834

• This assigns the December 2023 audit to the same commit used above for the July 2026 NEST audit, even though the replaced text identified ad6a9e83c095f5052e404bc13585ad2c752f242f as this report's audited commit. The current entry therefore overstates the 2023 report's coverage. Correct the audit source README and regenerate this page with the original audited commit.

Audited at commit [`10a2499`](https://github.com/lidofinance/stonks/tree/10a249971099be1b36c27f43a3f0a520389fb62e).

docs/security/audits.md:1345

• This note is a sentence fragment and ends with an unmatched asterisk. Correct it in the audit source README and regenerate the page.

This issue also appears on line 1385 of the same file.

> NB: It is not authored by Lido. Used by Lido Direct Staking Automation contracts*.

scripts/fetch.js:8

• The PR description says this only updates the audits page, but this change also adds an aggregate fetch workflow that runs LIP generation and on-chain multisig quorum checks, alongside broad parser and redirect refactors. Please expand the description and evidence so reviewers can validate these additional behavioral changes, or split them into a focused PR.

const TASKS = ['fetch-audits.js', 'fetch-lips.js', 'fetch-msig-quorums.js']

[lemonjelly27]

Thanks! I left a few inline comments/questions for clarification. Otherwise, the changes look good to me.

[lemonjelly27]

Rewards Share Committee says 3/5 but lists 6 signers

[lemonjelly27]

Same here: says 5/8 but lists 9 signers

[lemonjelly27]

Might be missing some context here, but could you please double-check this commit update? The 12-2023 Pessimistic Lido Stonks Audit now points to 10a2499, which is a July 2026 commit. IMO this looks inconsistent because a December 2023 audit normally should reference the version of the code that existed around the time of that audit, not a commit created almost three years later.

[lemonjelly27]

• seems extra here

[TheDZhon]

There is one failure-handling issue I'd fix before merging: fetch-msig-quorums.run() logs RPC errors but neither throws nor returns a nonzero status, and it writes successful changes even when other reads fail. With mocked RPC failures, I reproduced both 52 checked: 0 ok, 0 drift, 52 error with exit code 0 and a mixed result with one changed quorum, 51 errors, and a file write attempted.

Consequently, the new aggregate command can report that all tasks succeeded after an incomplete quorum refresh. Please propagate a nonzero status, gate quorum-file writes on complete coverage, and add regression coverage for both cases.