Make npm and Jest a first-class CI target

[Widthdom]

CLOSES #215

Summary

• Pin Node.js 24.18.0 and add a blocking javascript-tests job that runs npm ci, the complete Jest suite, and the High/Critical audit gate.
• Refresh the lockfile, update Jest to 30.4.x, and enable weekly npm Dependabot pull requests.
• Add regression coverage and bilingual testing/changelog documentation for the CI and supply-chain behavior.

Temporary audit exception

• Advisory: GHSA-mh99-v99m-4gvg (brace-expansion)
• Rationale: the latest Jest 30.4.x graph still requires glob/minimatch versions that cannot safely select the patched brace-expansion 5.0.8 major.
• Scope: development-only Jest/jsdom dependencies; a separate npm audit --omit=dev pass prevents the exception from covering production dependencies.
• Expiry: 2026-08-31. Expired exception entries fail CI even if the advisory has disappeared.

Validation

• npm ci
• npm run test:js — 184 passed
• npm run audit:high — passed with the single documented exception; production audit clean
• Focused CiAutomationConfigurationTests — 15 passed
• Full Release .NET suite — 2,033 passed, 1 known real-disassembler E2E skipped
• dotnet format ... --verify-no-changes
• git diff --check
• Final Codex review — no actionable defects