fix(deps): patch vulnerable transitive dependencies

HANDOFF.md

@@ -92,3 +92,11 @@ adds no new capture, render, provider, production or visual-quality certificatio
 The no-key bridge's named proof is `CURRENT-GATES-RETAINED-EVIDENCE-OBSERVED-DRIFT-REJECTED-01`. Unchanged main passed 43 parses, 36 tour assertions, 34 prose citations and three render records. The candidate passed 45 parses (two protocol files added), the same 36/34/3 assertions and 20 local scenarios with no failures or skips. The preserved old 13-scenario suite had passed while labelling a schema-only receipt verified; the corrected scenario returns observed, including failed and unbound references. These are different suites, not a speed comparison.
 
 The actual projection contains three observed historical assets and zero workflow receipt references, with not-certified/releaseReady false. Stale proof did not rewrite outputs; redirected directory/file outputs were rejected with foreign files unchanged; eight repeated rounds and two simultaneous disjoint fixture jobs passed. The [bridge update log](docs/NODEKIT_PRESENT_EVIDENCE.md) records the source/claim boundaries and preserved Windows launcher failure. No capture/render, provider, production, physical-device or pixel result was added by this work.
+
+## Transitive dependency audit update (2026-10-08)
+
+A developer using the retained Remotion 4.0.479 toolchain can install the patched lock without changing its top-level dependency versions or parent ranges. The pre-update lock audit reported one moderate [fast-uri advisory](https://github.com/advisories/GHSA-hrr3-gc8f-f4qj) and one high [source-map-js advisory](https://github.com/advisories/GHSA-68fv-2mgg-jv7q). The normal `npm update fast-uri source-map-js --package-lock-only` changed fast-uri 3.1.7 to 3.1.8 and source-map-js 1.2.1 to 1.2.2. Only their version, registry URL and integrity fields changed; the 233 lock entries and all other dependency records stayed the same.
+
+Named local proof `FEATURECLIP-TWO-TRANSITIVE-AUDIT-FIXES-01` passed: the new `npm audit --package-lock-only --json` returned zero findings, and `npm run check` passed 45 source parses, 36 tour assertions, 34 prose citations, three render-record byte bindings and all 20 existing scenarios with no failures or skips. The evidence proof still reports three observed historical assets, zero workflow receipt references and `releaseReady: false`.
+
+This run updated the lock only; it did not install dependencies, capture or render media, or certify security, pixels or release readiness. Remote CI, a fresh installed-tree audit and render compatibility remain pending at this proof capture time. The earlier dated output and audit results above remain historical.