feat(audit): dogfood the pip-audit dependency-audit gate on the maintainer repo

[maybebyte]

Summary

Dogfood the dependency-audit gate the template ships (roadmap gap #5): the maintainer repo now audits its own locked dependency graph with pip-audit, so it practices the guardrail it forces on every downstream.

Changes

• just audit — uv export the fully-resolved lockfile, then uvx pip-audit@2.10.1 over it (.gitignore backstop for the temp export). Out-of-band (chained into no recipe), mirroring how just scan is wired.
• CI — a pip-audit step in the existing scan job of test-template.yml (reuses the checkout + setup-uv; no new job, action, or token).
• Docs — new ## Dependency audit section in AGENTS.md (framing + pin-sync obligation) plus the design + plan under docs/superpowers/.

Testing

• just audit → 35 packages, no known vulnerabilities, exit 0.
• Non-vacuity check: uv export … --no-dev yields 0 packages vs 35 without it (confirms the gate is substantive, not vacuously green).
• Full generation matrix green (under the oldest supported Python); zizmor clean; ruff check / ruff format --check / basedpyright green.

Notes for reviewers

• --no-dev is deliberately dropped (the template keeps it). package = false puts every dep in the dev group, so the template's --no-dev export would be empty and pass vacuously here — dropping it audits the real ~35-package graph. Documented in AGENTS.md; do not restore it.
• pip-audit is non-hermetic (queries the OSV/PyPI advisory DB), so this gate can turn red on a newly-published CVE independent of any code change.

Related

• Closes gap docs(plans): add dogfooding-gap audit of shipped guardrails #5 in docs/superpowers/plans/2026-07-01-dogfood-gap-audit.md; follows gaps docs(specs): add dependency-inventory design spec #1 (pre-commit, chore(pre-commit): dogfood the shipped pre-commit gate on the maintainer repo #6) and docs(plan): add dependency-surface inventory implementation plan #2 (scanners, feat(scan): dogfood the shipped gitleaks + semgrep gate on the maintainer repo #7).