fix(audit): scope to GitHub-only and bundle CLI with esbuild

Narrow the posture audit to GitHub posture only. warden governs GitHub,
so multi-domain IaC auditing (aws/azure/k8s/docker/gcp/helm/gitlab/forgejo)
belongs to the separate blacklight app. The engine now wires only the
github CI lexicon (path-detected .github/workflows/*, github postSynthChecks).

Drop the 8 non-github lexicon dependencies; keep @intentius/chant and
@intentius/chant-lexicon-github.

Bundle the CLI with esbuild so chant's .ts source is transpiled and inlined
at build time. This fixes ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING when
running dist/cli.js under plain Node. chant packages export .ts by default,
which only worked under vitest's transpiler. Convert the engine's dynamic
chant imports to static top-level imports so esbuild inlines them.

Author: lex00

package-lock.json

@@ -10,22 +10,15 @@
   "scripts": {
     "tsc": "tsc --noEmit",
     "test": "vitest run",
-    "build": "tsc -p tsconfig.build.json && chmod +x dist/cli.js"
+    "build": "esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist/cli.js && chmod +x dist/cli.js"
   },
   "dependencies": {
     "@intentius/chant": "^0.8.2",
-    "@intentius/chant-lexicon-aws": "^0.8.2",
-    "@intentius/chant-lexicon-azure": "^0.8.2",
-    "@intentius/chant-lexicon-docker": "^0.8.2",
-    "@intentius/chant-lexicon-forgejo": "^0.8.2",
-    "@intentius/chant-lexicon-gcp": "^0.8.2",
-    "@intentius/chant-lexicon-github": "^0.8.2",
-    "@intentius/chant-lexicon-gitlab": "^0.8.2",
-    "@intentius/chant-lexicon-helm": "^0.8.2",
-    "@intentius/chant-lexicon-k8s": "^0.8.2"
+    "@intentius/chant-lexicon-github": "^0.8.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
+    "esbuild": "^0.28.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.9"
   }

package.json

@@ -2,7 +2,8 @@
  * Tests for the posture-audit engine and CLI subcommand.
  *
  * All tests are offline: a `fixtureFetch` intercepts GitHub API calls and
- * serves an in-memory file set that exercises multiple lexicons.
+ * serves an in-memory file set that exercises the github lexicon (warden audits
+ * GitHub posture only).
  */
 
 import { describe, it, expect } from "vitest";
@@ -26,20 +27,6 @@ const FIXTURE_FILES: Record<string, string> = {
     "      - uses: actions/checkout@v4",
     "      - run: echo ${{ github.event.issue.title }}",
   ].join("\n") + "\n",
-  "k8s/deploy.yaml": [
-    "apiVersion: apps/v1",
-    "kind: Deployment",
-    "metadata:",
-    "  name: web",
-    "spec:",
-    "  template:",
-    "    spec:",
-    "      containers:",
-    "        - name: c",
-    "          image: nginx:latest",
-    "          securityContext:",
-    "            privileged: true",
-  ].join("\n") + "\n",
 };
 
 /** Produce a GitHub-shaped mock fetch serving the given file set. */