fix: update security-audit.html with 2026-08-17 audit results

[enricopiovesan]

Summary

Reconciliation (Step 1): all 8 findings still marked "Open" in the register — #782, #783, #784, #785, #786, #788, #789, #627 — were checked against their linked GitHub issue's live state. All 8 are now Closed. Each row's status flipped to Closed with a "Resolved <date>" note appended using the ticket's real closedAt date. No finding text, severity, or ordering was reworded — only status/date fields changed, per instructions.

New findings (Step 2): added a third batch, "New findings — audited 2026-08-17, commit 1104473":

• Medium/Portability — traverse-runtime's inference module has no wasm32 gating despite blocking TcpStream I/O (#1065)
• Medium/Security — the gRPC EventService has no concurrency cap or idle timeout, CWE-400 (#1066)

⚠️ One deviation from the request, flagged explicitly: the request specified #1065 as Status: Open. Live-checked it against gh issue view — it was actually closed today, 2026-08-17, stateReason: COMPLETED, same day as this audit. The page's own findings-register note already states "Status reflects the linked GitHub issue's tracker state, not a re-audit of the fix," so I recorded it Closed to keep the page consistent with its own documented policy rather than publish a status I could see was already stale. #1066 is correctly Open as specified. Happy to flip #1065 back to Open if you'd rather the page reflect audit-day state specifically — just say so.

Step 3: header updated to "Updated 2026-08-17, commit 1104473" (text + commit link href); jsonLd.dateModified updated to match. Summary counts are computed automatically from the findings arrays (not hand-typed), so they update correctly from both the reconciliation and the two new rows.

Step 4: added one bullet to "Security strengths" noting the app-event/gRPC eventing subsystem was reviewed 2026-08-17 and found soundly designed — no new finding added, since nothing was wrong there.

Verified real before writing: gh issue view for all 8 reconciled tickets + #1065/#1066, and gh api compare confirming commit 1104473 is a real ancestor of main.

Test plan

• npm run build — 87 pages, no errors
• Verified via DOM: header shows updated date/commit; summary stat counts (2 Critical/6 High/12 Medium/3 Low, correct closed-vs-open splits) match manual count of the underlying data; both new rows render with correct ticket links and status; new strengths bullet present
• Confirmed only one status-pill on the whole page still reads "Open" (#1066)