security: mitigate dependabot alert #24 by updating flatted and brace-expansion

[jbarson]

Mitigates security vulnerabilities found by npm audit (flatted and brace-expansion).

[Copilot]

Pull request overview

Mitigates npm audit/dependabot alerts by updating vulnerable transitive npm packages in the lockfile, plus adds contributor/agent guidance on PR iteration.

Changes:

• Bumps brace-expansion (both v1 and v2 variants) in package-lock.json.
• Bumps flatted in package-lock.json.
• Adds PR review/iteration guidance to GEMINI.md and a new .jules/agent-behavior.md note.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 4 comments.

File	Description
package-lock.json	Updates resolved versions/integrity for brace-expansion and flatted to address audit alerts.
GEMINI.md	Adds a new “PR Review & Iteration” standards section.
.jules/agent-behavior.md	Introduces an agent behavior note about proactively resolving PR feedback.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This calls out running the "Quality Gate" but the inline list omits npm run lint:fix, which GEMINI.md defines as part of the mandatory Quality Gate. To avoid conflicting instructions, either reference the Quality Gate without listing commands, or include the full set of required commands.

Suggested change

	**Action:** Before marking a task as complete, always check for open PR comments using `gh pr view --comments`. If changes are requested, Jules must proactively check out the existing branch, apply the fixes, run the Quality Gate (`npm run format`, `npm run lint:ci`, `npm test`), and push the updates to the same branch to resolve the feedback loop.
	**Action:** Before marking a task as complete, always check for open PR comments using `gh pr view --comments`. If changes are requested, Jules must proactively check out the existing branch, apply the fixes, run the Quality Gate (`npm run format`, `npm run lint:fix`, `npm run lint:ci`, `npm test`), and push the updates to the same branch to resolve the feedback loop.

[Copilot]

The PR title/description indicate this change is purely about mitigating npm audit vulnerabilities, but this new section adds process guidance for PR review/iteration. Consider moving these workflow/documentation updates to a separate PR, or update the PR description to explicitly include them so reviewers understand the scope.

[Copilot]

This references the "Quality Gate" but lists only npm run format, npm run lint:ci, and npm test. In section 3.2 above, the Quality Gate also includes npm run lint:fix; consider either referencing the full command list or updating this parenthetical to match the documented Quality Gate steps.

Suggested change

	- **Verification**: After addressing feedback, re-run the Quality Gate (`npm run format`, `npm run lint:ci`, `npm test`) and push the changes immediately.
	- **Verification**: After addressing feedback, re-run the Quality Gate (`npm run format`, `npm run lint:fix`, `npm run lint:ci`, `npm test`) and push the changes immediately.

[Copilot]

This new file is about PR review management, which doesn't appear to relate to the PR's stated purpose of updating vulnerable npm dependencies. Consider moving it to a separate PR, or at least updating the PR description so the additional scope is intentional and clear during review.