fix: audit hardening pass — XSS, crash, drift alert, a11y, CI (v3.0.1)

[New1Direction]

Summary

A correctness, security, and tooling pass from a full code audit of RepoLens — no feature changes. Ships as v3.0.1 and reconciles the long-standing version drift (manifest 3.0.0 vs package.json 1.7.0 → both 3.0.1).

Fixed

• Batch scanner XSS — batch.js rendered provider error messages and pasted URLs straight into innerHTML; both are now HTML-escaped (the file imported no escaper at all).
• Compare-modal crash — library.js threw ReferenceError: FIT_ORDER is not defined on the Fit-delta cell because the constant was scoped to the wrong function. Hoisted to one module constant; the duplicate locals were removed.
• Drift alert was dead — the daily stale-repos check read savedAt, but the store writes saved_at, so it always counted zero. Field names now match.
• Reduced-motion leaks — the Batch & Stack loaders pulsed forever; both now honour prefers-reduced-motion.
• WCAG AA contrast — darkened --text-faint on the five light themes (paper, cream, apple, latte, solarized) + the website.

Changed / hardened

• Explicit content_security_policy in the manifest (matches the MV3 default, now auditable).
• background.js: .catch on the RERUN path (no more stuck spinner); immutable combinator seed; removed two production console.log.
• format.js: esc() now escapes single quotes (matches the canonical safe-html escaper).
• CI: npm install → npm ci (lockfile regenerated + in sync), lint promoted to a blocking gate (was advisory), advisory npm audit step added; ESLint now lints .mjs so the dev driver stops flooding no-undef.

Docs

• CHANGELOG [3.0.1] — Audit hardening + README "What's new" block + version badge.
• Full audit report committed at docs/audits/audit-2026-06-15-deep-review.html.

Test plan

• npm test — 733/733 passing
• npm run lint — 0 errors (was 15)
• Independent code-review pass — approved, no critical/high regressions
• Load the unpacked extension: run a Batch scan and confirm error rows render escaped; open the Compare modal on repos with a fit-delta (no crash); trigger the drift alarm and confirm the stale count is non-zero
• With prefers-reduced-motion: reduce, confirm the Batch/Stack loaders don't pulse
• Eyeball the five light themes for the darker faint-label text

Deferred (own PRs)

Splitting the three monoliths, extracting the provider engine/message router for testability, library-grid virtualization, Playwright E2E, the vitest major bump, and three proposed features — all detailed in the audit report.