v1.8.3

• Infra: Added a real CI workflow (Node 18/20/22 matrix) backed by a new stdio smoke test, plus a CodeQL workflow. Both were previously entirely absent, which is why Glama's quality page showed "CI status not available" and "No code scanning findings" — those meant "never measured," not a clean bill of health.
• Fix: Regenerated package-lock.json (it predated @xenova/transformers's optional-dep subtree ever being resolved, which broke npm ci on a clean runner) and ran npm audit fix to clear the @modelcontextprotocol/sdk-transitive advisories.
• Known issue: @xenova/transformers (optional, powers semantic recall) still carries a critical + 4 high severity CVE chain via old onnxruntime-web/protobufjs/sharp; the only fix is a breaking downgrade to 1.4.2, tracked as a follow-up rather than forced in blind.