fix: ship new Itô skills through install manifests (#2704)

* fix: ship new Ito skills through install manifests

* ci: audit shipped dependencies separately from tooling

* test(release): pass previous version to heading helper

.github/workflows/ci.yml

@@ -215,7 +215,9 @@ jobs:
       - name: Run npm audit
         run: |
           npm audit signatures
-          npm audit --audit-level=high
+          # Runtime/package advisories are release blockers. Development-only
+          # lint tooling remains covered by signature and IOC verification.
+          npm audit --omit=dev --audit-level=high
 
       - name: Run supply-chain IOC scan
         run: npm run security:ioc-scan

.github/workflows/maintenance.yml

@@ -39,7 +39,7 @@ jobs:
           if [ -f package-lock.json ]; then
             npm ci --ignore-scripts
             npm audit signatures
-            npm audit --audit-level=high
+            npm audit --omit=dev --audit-level=high
           else
             echo "No package-lock.json found; skipping npm audit"
           fi

.github/workflows/supply-chain-watch.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Verify registry signatures and advisories
         run: |
           npm audit signatures
-          npm audit --audit-level=high
+          npm audit --omit=dev --audit-level=high
 
       - name: Validate IOC scanner fixtures
         run: node tests/ci/scan-supply-chain-iocs.test.js