docs(ci): record why the escalation job's setup-node scan finding was dismissed

[JSONbored]

Follow-up to #10147 (comment-only, no behaviour change).

A security scanner flagged actions/setup-node in the new escalate-persistent-failure job as a filesystem-read risk (P1), citing __tests__/authutil.test.ts.

Reviewed and dismissed. The evidence:

1. Test fixture, not runtime. authutil.test.ts lives inside setup-node's own repository and exercises its .npmrc auth-token feature. Test files in an action's repo do not execute when the action runs.
2. The capability is inert in this job. That feature only engages when registry-url is supplied. In this repo that happens in exactly five places — all publish-*.yml — and deliberately not here. This step passes only node-version-file, so setup-node never touches .npmrc or any credential path.
3. No new surface. The pin is the same SHA as all 32 other setup-node uses in the repo, including build-boot in this same file. The job introduced no dependency that was not already present.

The job is also already minimal: persist-credentials: false on checkout, permissions scoped to contents: read + issues: write, no npm ci, and a script whose only import is node:child_process.

This PR records that reasoning at the call site so the next scan does not cost another investigation — and names the condition that would invalidate it (this step gaining registry-url) rather than dismissing the rule outright.

[loopover-orb]

Important

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏳ LoopOver is waiting…

LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting}

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.05%. Comparing base (dcce55c) to head (44b5c9e).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##             main   #10153       +/-   ##
===========================================
+ Coverage   80.13%   92.05%   +11.92%     
===========================================
  Files         282      931      +649     
  Lines       58742   114046    +55304     
  Branches     6963    27543    +20580     
===========================================
+ Hits        47070   104989    +57919     
+ Misses      11381     7759     -3622     
- Partials      291     1298     +1007     

Flag	Coverage Δ
backend	95.68% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 782 files with indirect coverage changes