chore(deps): npm audit fix before release bump; monthly npm-outdated issue

Adds npm audit fix (root + every client) as the first sub-step of the
release skill's bump step, before npm version, so a release is never
gated on remembering to check separately. Never --force; anything
audit fix can't resolve is left to the dependabot-alert pipeline
(#2229) or a follow-up issue.

Disables Dependabot npm version updates in dependabot.yml (a
version-update PR carries no issue and no board card) and replaces
them with a monthly scheduled sweep that runs npm outdated across the
root install and every client, filing or updating one idempotent
tracking issue instead of an auto-generated PR.

Closes #2231
Part of #2229

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017N9ha27Qg6LHpBQP7G7zPY
Signed-off-by: cliffhall <cliff@futurescale.com>

.github/workflows/dependency-refresh.yml

@@ -0,0 +1,48 @@
+# Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
+#
+# Dependabot version updates are disabled in `.github/dependabot.yml` because a
+# version-update PR carries no issue and no board card. This workflow runs
+# `scripts/dependency-refresh.mjs` against `v2/main` once a month and files or
+# updates ONE tracking issue listing every outdated package across the root
+# install and each client — no PR is opened automatically. A maintainer reviews
+# the issue, picks what to bump, and opens a normal PR against `v2/main`.
+#
+# `GITHUB_TOKEN` is sufficient: it only needs to read milestones (public) and
+# create/edit an issue (`issues: write`). Board placement is intentionally NOT
+# attempted here — that needs an org-project PAT this token cannot have — so a
+# filed-but-unboarded issue is picked up by the next `/issue-triage` sweep,
+# same as any other maintainer-filed issue.
+name: Dependency Refresh
+
+on:
+  schedule:
+    - cron: "23 6 1 * *" # 06:23 UTC on the 1st of every month
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  npm-outdated:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout v2/main
+        uses: actions/checkout@v7
+        with:
+          ref: v2/main
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '22.x'
+          cache: 'npm'
+
+      - name: Install dependencies (root + all clients)
+        run: npm install
+
+      - name: Run the npm-outdated sweep
+        run: node scripts/dependency-refresh.mjs
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_REPOSITORY: ${{ github.repository }}