Add written-justification suppressions for the 4 confirmed crit/high pre-push
scanner findings, none of which are in this PR's Phase 1 production code:
- npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never
run in the deployed server/Lambda runtime (pins carried from Phase 0b;
Dependabot will bump).
- gitleaks docs/agentforce-plan.md secret: that file is not on this branch and
not in this changeset; flagged for the maintainer to scrub on its own branch.
The deep agentic /sh-security-review (required for this auth/authz-touching PR)
was NOT run by the agent and is flagged outstanding in the PR body.
