fix(ci): time-box braces audit exception

.github/workflows/verify.yml

@@ -54,7 +54,7 @@ jobs:
         if: runner.os == 'Linux' && !cancelled()
       - run: bun run typecheck
         if: runner.os == 'Linux' && !cancelled()
-      - run: bun audit
+      - run: bun run audit
         if: runner.os == 'Linux' && !cancelled()
       - run: bun run secrets:check
         if: runner.os == 'Linux' && !cancelled()

package.json

@@ -20,6 +20,7 @@
     "!dist/bin"
   ],
   "scripts": {
+    "audit": "bun audit --ignore GHSA-vfj7-8cjw-p6xm",
     "build": "bun scripts/build.ts bundle",
     "compile": "bun run compile:darwin-x64 && bun run compile:darwin-arm64 && bun run compile:linux-x64 && bun run compile:linux-arm64 && bun run compile:windows-x64 && bun run compile:windows-arm64",
     "compile:darwin-x64": "bun scripts/build.ts compile bun-darwin-x64",

src/techDebt.test.ts

@@ -0,0 +1,6 @@
+import { techDebtTest } from "./testing/techDebt.ts";
+
+techDebtTest(
+  new Date("2026-10-13T20:37:51.000Z"),
+  "The braces audit exception expired. Check https://github.com/advisories/GHSA-vfj7-8cjw-p6xm for a patched release, update bun.lock, and remove the audit ignore.",
+);

src/testing/techDebt.ts

@@ -0,0 +1,13 @@
+import { expect, test } from "bun:test";
+
+export function techDebtTest(expiresAt: Date, message: string): void {
+  test(`tech debt review deadline: ${expiresAt.toISOString()}`, () => {
+    const now = Date.now();
+
+    if (now >= expiresAt.getTime()) {
+      console.error(message);
+    }
+
+    expect(now).toBeLessThan(expiresAt.getTime());
+  });
+}