chore: remove unused files and update vulnerable dependencies

[Kevin-Umali]

What changed

Remove the unreferenced motion review and deferred threats-page planning note, four unused Astro components, unused CSS selectors, and illustration counter bookkeeping. Retained illustration exports produce identical output; removed selectors match no elements in the built site. Page markup, wording, browser behavior, and scanner source are unchanged.

Update vulnerable npm dependencies, Brotli to 1.2.6, and the Go toolchain and digest-pinned sandbox builder to 1.26.9. Include the pinned workflow-action updates from Dependabot PR #32. Supersedes dependency PRs #29, #32, and #35 after merging; #30 and #34 have already merged.

Security and detection impact

No scanner safety boundary, detection rule, output schema, or application logic changes. Dependency and standard-library security fixes are included.

Verification

Passed locally:

• GOTOOLCHAIN=go1.26.9 make check (gofmt, vet, full race-test suite)
• GOTOOLCHAIN=go1.26.9 go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./... (no vulnerabilities found)
• npm audit --audit-level=low in site/ (zero vulnerabilities)
• npm --prefix site run check, npm --prefix site run format:check, npm --prefix site run build
• python3 site/check_docs.py (16 routes, 255 search destinations, 6 artifacts)
• python3 -m unittest discover -s scripts -p 'test_*.py' (13 tests)
• GOTOOLCHAIN=go1.26.9 go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
• Diff whitespace check, unchanged application/page/copy source, identical retained illustration output, unused-selector verification, and public Docker builder manifest digest verification.

The whole-repository formatting check still reports pre-existing formatting drift in untouched files. Broad formatting-only changes were excluded to keep this cleanup focused. The existing deprecated clipboard-fallback hint remains. Docker and GitHub workflow execution are validated by PR CI.