chore(deps-dev): bump the npm-development group with 5 updates

.github/workflows/vetted.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Vetted AI Code Review
-        uses: makoydev/vetted@f6ae25e2c71b7444af3a863adcc8296df544e52b # next, 2026-09-30 (#21)
+        uses: makoydev/vetted@2ae958e0fbf14fb9c74c2423059a49762927a192 # v0.1.0
         with:
           # Opt-in since #9: add the `ai-review` label to get comments.
           mode: opt-in

CHANGELOG.md

@@ -6,6 +6,10 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+### Changed
+
+- Vetted's self-review is pinned to the v0.1.0 release commit.
+
 ## [0.1.0] - 2026-10-01
 
 First release (Milestone 1): governed, advisory AI code review for GitHub Actions. Reviewed and approved by Michael Mendoza on 2026-10-01.

docs/HOW-THIS-WAS-BUILT.md

@@ -42,6 +42,8 @@ On 2026-10-01 Michael reviewed the batch in `next` with the Milestone 1 decision
 
 | Date       | What went wrong                                                                                                                                                                                                                                                                                                             | How it was caught                                                                                                                         | Fix                                                                                                                                                                              |
 | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 2026-10-01 | After realigning `next` with `main`, a new branch was created from a local copy of `next` fetched before the realignment, so its pull request carried 14 old commits, conflicted, and triggered no checks                                                                                                                   | The merge helper reported that no checks had run; the pull request showed 14 commits and a conflict                                       | Rebased the one real commit onto the realigned `next`; fetch immediately before branching                                                                                        |
+| 2026-10-02 | While making the explainer film, the fake cloud key written for the sample code contained the digit 9. Real AWS access key IDs only use A–Z and 2–7, so Vetted's rule correctly ignored it and the film would have shown a secret that Vetted doesn't wrap                                                                  | Running the film's sample lines through the real v0.1.0 engine before animating them, which left the key unwrapped                        | Replaced the key with a correctly shaped fake; every label in the film now matches what the engine produces                                                                      |
 | 2026-10-01 | The changelog had two "Added" sections and entries out of order, from text-anchored edits over several pull requests                                                                                                                                                                                                        | Preparing the release                                                                                                                     | Rewrote it as one clean `0.1.0` entry                                                                                                                                            |
 | 2026-09-30 | The first canary meant to prove the path deny list works ("only the deny list can stop this") was actually also caught by the entropy check, so it didn't test the deny list                                                                                                                                                | A deliberate break (deny list emptied) still reported 0 leaks                                                                             | Replaced it with a passphrase with spaces that nothing else catches; the same break now reports 3 leaks                                                                          |
 | 2026-09-30 | Two overclaims in drafts: the threat model said CODEOWNERS "covers" workflow changes (with zero required approvals it enforces nothing), and `EVALS.md` gave the monthly worst case as US$6.24 (it is US$6.20)                                                                                                              | Re-reading the drafts before committing                                                                                                   | Corrected before they were committed                                                                                                                                             |