v0.11.2

Stops a slow npm registry failing the whole build.

bin/importmap audit asks the npm registry which pinned packages have advisories against them. That endpoint answers either side of the sixty second read timeout importmap gives it, so about half of all CI runs failed on it — on diffs containing no JavaScript at all.

A transport failure is now reported and tolerated. Anything else the audit says still fails the build. The tolerance lives in bin/importmap-audit, which both bin/ci and the scan_js workflow job call, so the two cannot disagree about what a slow registry means.

No application code changed in this release.