chore(release): bump shield to 0.1.27

[andrei-hasna]

Summary

• bump @hasna/shield from 0.1.26 to 0.1.27
• update the legacy @hasna/security compatibility package to depend on @hasna/shield@0.1.27
• keep all Bun lockfiles unchanged; bun install --frozen-lockfile reports no changes

Verification

• bun run typecheck: pass
• bun run check:secrets: 0 violations
• bun test --parallel=1 --timeout 30000: 437 pass, 0 fail
• bun run build: pass
• bun scripts/no-cloud-artifact-scan.mjs: pass, 69 files
• jq empty package.json compat/security/package.json: pass
• git diff --check origin/main...HEAD: pass
• pre-push hook: scanned 1 outgoing commit

The unmodified local bun run prepublishOnly command was run twice. Both runs reached the test suite and timed out only in the unchanged credential-invariant test at the default five-second limit while station load was near 30; secrets passed, and the build/artifact lanes pass independently above. Hosted CI exercises the default test command on this exact head.

Todos: SHI-00001 (d0bb42cb-27a2-42f0-96e4-afcc59f3147e)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #10 @ 3075338 — lens: correctness+security+gates, reviewer Aruns (1 of 1)

Reviewed the exact three-dot diff from freshly fetched origin/main 72dc25f to head 3075338. Read the full diff and the complete surrounding package manifests in package.json and compat/security/package.json. The change aligns @hasna/shield at 0.1.27 with the legacy @hasna/security dependency pin at 0.1.27.

Commands run, captured unpiped with stdout and stderr kept separate:

• bun install — exit 0; setup only, 211 packages installed; not counted as a test gate.
• bun run typecheck — exit 0; pass/fail counts not emitted by tsc.
• bun run test — exit 0; 437 pass, 0 fail, 7035 expect() calls across 46 files.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.