Add npm audit fix to the release flow and a monthly npm-outdated tracking issue

[cliffhall]

Sub-slice of #2229, scoped to the two pieces of that proposal that don't depend on the still-unbuilt alert-driven pipeline:

1. npm audit fix before the version bump, on v2/main. Currently the /release skill's step 1 is bump-only. Add an audit-and-fix pass ahead of it (root + every client, since each has its own lockfile), gated by npm run local:gate before the bump proceeds, with an explicit "never --force" rule and a pointer to the alert pipeline / overrides for whatever fix can't resolve on its own.
2. Disable npm version updates, replace with a monthly tracking issue. Remove the npm entries from .github/dependabot.yml (keep github-actions, out of scope here) and add a scheduled workflow that runs npm outdated across the root install and every client, filing or updating one idempotent tracking issue — no auto-generated PR, matching Workflow: disable Dependabot PRs and drive security fixes from alerts into board-tracked issues #2229's reasoning that a bot-authored PR with no issue and no board card is the thing being eliminated.

Both are called out as concrete, buildable-now recommendations in #2229's body; this issue exists so they land without waiting on the larger alert-consuming sweep, which stays open there.

Acceptance

• /release's step 1 runs npm audit fix (root + all four clients) before npm version, with npm run local:gate confirming nothing broke, and documents the --force prohibition and the escalation path for anything left unresolved.
• .github/dependabot.yml has no npm ecosystem entries; github-actions is unchanged.
• A new scheduled workflow runs monthly (plus workflow_dispatch), computes npm outdated --json per install, and files/updates one issue listing everything outdated, labeled v2 + chore + dependabot, milestoned to the current release when one is open.
• A second run before that issue closes updates it in place rather than duplicating it.
• The pure parsing/formatting logic backing the workflow has unit test coverage.

Part of #2229 — the alert-driven security pipeline in that issue is unaffected and stays open.