fix: address CodeRabbit review round 10 - 5 issues

[adrozdenko]

Summary

Addresses all 5 issues from CodeRabbit review round 10:

• Security: Disable external $ref resolution in SwaggerParser.validate() to prevent SSRF — specs with remote $ref URLs no longer trigger network requests. Updated SECURITY.md accordingly.
• Minor: Add runtime HTTP method validation in withSequence() before indexing http[method], preventing cryptic errors for unsupported methods like CONNECT or TRACE.
• Trivial: Document the related_pattern frontmatter field in docs/vault/_schema.md.
• Trivial: Align Node.js version requirements — drop Node 18 from CI matrix, update README from "18+" to "20.11+" to match package.json engines.node: ">=20.11.0".
• Trivial: Fix Phase 2 → Phase 3 header comment in src/core/scenarios/types.ts.

Test plan

• npm run typecheck — passes
• npm run test:run — 181 tests pass, 4 skipped
• CodeRabbit full review

Summary by CodeRabbit

Release Notes

• Documentation

  • Updated minimum Node.js requirement to version 20.11+

• Security

  • Disabled external OpenAPI reference resolution to prevent SSRF vulnerabilities

• Chores

  • Reduced CI test matrix to Node.js versions 20 and 22
  • Added HTTP method validation for improved type safety

[coderabbitai]

Walkthrough

Updates Node.js minimum version requirement to 20.11+, reduces CI test matrix to versions 20 and 22, disables external OpenAPI reference resolution for security, adds HTTP method validation in sequence handler, and updates file metadata.

Changes

Cohort / File(s)	Summary
CI/Build Configuration .github/workflows/ci.yml, README.md	Reduced CI test matrix from Node versions 18, 20, 22 to 20, 22; updated minimum Node.js requirement in documentation from 18+ to 20.11+.
Security & Parser SECURITY.md, src/core/parser/index.ts	Documented and implemented disabling external $ref resolution in OpenAPI parser by setting resolve.external: false in SwaggerParser.validate to prevent SSRF attacks; only local file references are resolved.
Runtime Enhancement src/runtime/with-sequence.ts	Introduced SUPPORTED_METHODS list with HTTP method validation before MSW handler wiring; throws error if method not supported; improved type safety by using http[methodLower as keyof typeof http] pattern.
Documentation & Metadata docs/vault/_schema.md, src/core/scenarios/types.ts	Added inline comment to schema YAML frontmatter explaining cross-link ID; updated file header comment from "Pactwork Phase 2" to "Pactwork Phase 3".

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title references CodeRabbit review round 10 but the actual changes span multiple unrelated concerns: security (SSRF prevention), runtime validation, documentation, version alignment, and a comment fix. While accurate, the title is vague about what was fixed.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/review-round-10

---

No actionable comments were generated in the recent review. 🎉

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}