ci(root): migrate dependency audit from improved-yarn-audit to osv-scanner

[roshan-bitgo]

Summary

Replaces improved-yarn-audit with google/osv-scanner-action in both release workflows.

Why: npm permanently retired the legacy security audits endpoint (/-/npm/v1/security/audits) on 2026-07-15 with HTTP 410. Yarn v1's yarn audit calls this endpoint; improved-yarn-audit wraps yarn audit and inherits the breakage. The yarn team closed the fix as "not planned" — yarn classic's audit is permanently broken.

Why osv-scanner: Unlike audit-ci (which also calls yarn audit --json under the hood for Yarn Classic), osv-scanner reads yarn.lock directly and queries the OSV.dev database. No npm registry dependency. Works identically locally and in CI.

Changes

• .github/workflows/publish.yml — replace broken audit step with osv-scanner-action@v2
• .github/workflows/npmjs-release.yml — replace broken audit step with osv-scanner-action@v2
• package.json — remove improved-yarn-audit devDependency and audit-high script
• osv-scanner.toml — new config; all 14 exclusions migrated 1:1 from .iyarc with original justifications preserved
• .iyarc — deleted (superseded by osv-scanner.toml)
• .claude/agents/iyarc-prune.md — updated all references to osv-scanner.toml and new CLI invocation

Security posture

All 14 existing CVE exclusions are preserved with their original justifications. Severity threshold remains HIGH+. No change to which vulnerabilities are accepted.

Follows the immediate unblock in #9262. Tracked in VL-7134.