[pacphi]

Aligns v2 with the repo-wide dependency-audit standard.

Merge order: merge this only after main's ci(main): standard dependency audit PR. That PR adds the Dependency Audit job to the reusable ci-v2.yml, which runs this branch's .github/scripts/v2/npm-audit.sh. This PR removes the branch-local npm-audit job from the shim, so until main's PR merges, no npm audit runs on this PR's CI. The audit was run locally instead (output below).

Changes

• v2/audit-ignore → v2/npm-audit-ignore. The entry is now a bare GHSA id (GHSA-83w8-p2f5-377r), the standard format. The lockfile path moved into the justification comment, and an advisory link was added. The justification is otherwise unchanged.
• .github/scripts/v2/npm-audit.sh is replaced with the standard script, byte-identical to v2.5.x (git blob c794a63b232267e4a331641c65696de96a9b71b9, sha256 95dffb5a531cd500806868995306dbd7ee4cd353c26b3ec49d7c50f60bd8563a). It runs npm audit --audit-level=high against every committed v2/**/package-lock.json, reads v2/npm-audit-ignore, fails closed when npm returns no usable report, and warns on stale exceptions (the old script failed on them).
• .github/workflows/ci.yml (shim): removed the npm-audit job and updated the header comment. .github/scripts/v2/** stays in the push paths filter, so edits to the script still trigger CI.

Local audit (node 26.12.1, npm 12.2.0)

Ignoring 1 advisory exception(s) from v2/npm-audit-ignore:
  - GHSA-83w8-p2f5-377r

=== npm audit --audit-level=high: v2/docker/lib/extensions/vf-management-api/resources/package-lock.json
  totals: critical=0 high=1 moderate=2 low=0
  IGNORED GHSA-83w8-p2f5-377r (high) @fastify/static <=10.1.0: @fastify/static vulnerable to route guard bypass via path traversal

npm audit gate passed (1 lockfile(s))
exit=0

Also checked:

• With an unreachable registry the script fails closed (npm audit returned no usable report, exit 1).
• A dummy stale ID produces a ::warning and the script still exits 0.
• shellcheck, yamllint and prettier --check pass.

🤖 Generated with Claude Code