chore: establish legacy boundary and clear security audit

[hubofwyn]

Summary

• establish WynIsBuff2 as the independent original JavaScript and Phaser 3 project, with Wyn der Schrank documented as a separate rebuild
• add docs/PROJECT_STATUS.md as the current-work authority and preserve older plans as historical evidence
• refresh compatible dependencies, regenerate bun.lock, and clear the high-severity audit gate without crossing framework or tooling majors
• pin Bun 1.3.14 through packageManager, Mise, and setup-bun; update checkout to v7
• keep the non-blocking SettingsScene and PerformanceConfig warnings assigned to L-003
• supersede stale dependency PR chore: update all dependencies to latest versions #11 after this PR merges
• retain the accepted status wording: “Working prototype; current development activity unverified.”

No deployment is performed or claimed by this change. Phaser remains 3.90.0; Phaser 4 belongs only to the separate rebuild.

Validation

• bun install --frozen-lockfile
• bun audit --audit-level=high — zero findings
• bun test — 15 test files pass
• bun run lint — passes with the one recorded SettingsScene warning
• bun run deps:check — passes with the one recorded PerformanceConfig warning
• bun run arch:health — 4/4
• bun run format:check — Prettier clean; 172 Markdown files, 0 errors
• bun run build-nolog
• all workflow YAML files parse
• signed commit and repository pre-commit gate pass