✨ feat(supply-chain): enumerate active advisory exceptions in passing audit output

[konih]

What

Resolves F1 (P3) from the independent review of PR #44: a passing scripts/dependency-audit.mjs run printed only the raw count line (high=2) plus a generic "no unexcepted high or critical advisories" message, so an operator reading CI logs could not tell which advisories were waived without opening supply-chain/dependency-audit.json.

A passing run now appends an Active exceptions (N): block naming each valid exception — GHSA id, waived package (from the matched advisory's module_name), expiry date, and reason — right next to the green verdict. An exception with no matching advisory in the current run is still listed, flagged (no matching advisory in this run). A pass with zero exceptions keeps the plain one-line message.

What did NOT change

• No pass/fail semantics changed — output only. All failure paths (expired, malformed, unexcepted) emit exactly the messages they did before.
• Files touched: scripts/dependency-audit.mjs, scripts/dependency-audit.test.mjs only. No supply-chain/README.md change needed — the behavior is self-describing in the output.

TDD / mutation evidence

• Wrote 3 tests first (enumeration with id+package+expiry+reason; unmatched-exception listing; no section when no exceptions): suite went 24 pass / 2 fail before the implementation.
• Mutation check: removing the enumeration (reverting the pass message to the plain string) turns the two enumeration tests red; restoring turns the suite green (26/26).

Gates

• node scripts/dependency-audit.mjs — exit 0, both GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq enumerated with package/expiry/reason
• node --test scripts/dependency-audit.test.mjs — 26/26 pass
• pnpm build — green
• pnpm test:deck — 57/57 pass (lockfile untouched)

[konih]

Independent review — APPROVE (coordinator-dispatched, not the author)

Head: e5caa59 · Verdict: APPROVE — one hypothetical P3 note, nothing blocking.

Verified with evidence:

• Pass/fail semantics untouched — the refactor is an early-return of the same errors.length === 0 predicate; every failure message is constructed identically, main()'s exit-code paths are outside the diff, and the new pass-path code cannot throw. A security gate's output refactor was treated as P0 territory and cleared.
• Live run at head: exit 0 with both image-size GHSAs enumerated (package, expiry 2026-10-08, reason) beside the green verdict.
• Non-vacuity: 3 mutants killed independently (strip enumeration, drop unmatched-exception fallback, force section at zero exceptions), restore → 26/26 green.
• Pre-existing 23 tests strictly unmodified (diff purely additive), so the "failure output unchanged" claim is enforced, not asserted.
• Scope exactly the two owned files; single gitmoji-conventional commit; CI 10/10 green.

Finding (P3, note only): if two report advisories ever shared one GHSA id, waivedPackages.set last-write-wins and only one module name prints — hypothetical (npm audit keys advisories uniquely) and output-only.