web: remove stale vulnerable npm lockfile

[BenevolentFutures]

Summary

• Remove the stale web/package-lock.json, which resolved Next.js 16.2.6.
• Keep web/bun.lock as the only web lockfile; it resolves Next.js 16.3.4.
• Leave .github/dependabot.yml unchanged because it already watches the Bun ecosystem in /web.
• Correct the historical web drift note now that the finding is resolved.

Deployment audit

• The documented Stage11 Vercel account is authenticated as benevolentfutures-7299.
• The Stage11 team has no c11, c11-web, or web project, and c11.stage11.systems is not among its domains.
• The repository has no web/vercel.json or linked Vercel project metadata, and c11.stage11.systems currently has no DNS resolution.
• Therefore there is no authorized Stage11 Vercel deployment evidence showing that the stale npm lockfile is used; no deployed-site exposure alert was sent.
• Dependabot alerts crash-visibility: add launch sentinel for Force-Quit detection #109 and c11-24: c11 health CLI (passive crash visibility, four rails) #110 are currently open against web/package-lock.json. Removing that manifest is the change expected to close both alerts after merge; Dependabot is already configured to follow web/bun.lock.

Validation

• bun install --frozen-lockfile — passed; Bun 1.3.14, 448 installs checked across 547 packages, no changes.
• bun tsc --noEmit — passed.
• RESEND_API_KEY=local-placeholder C11_FEEDBACK_FROM_EMAIL=build@example.com C11_FEEDBACK_TO_EMAIL=build@example.com C11_FEEDBACK_RATE_LIMIT_ID=local-test bun run build — passed with Next.js 16.3.4; 407 static pages generated. The existing build emitted wallOfLove missing-message diagnostics for non-English locales and the existing multiple-lockfile workspace-root warning, but exited 0.
• bun run lint — unchanged from baseline: 5 errors and 7 warnings (exit 1), matching the known C11-214 errors.
• No Xcode build, test action, or tagged app was run, per C11-223.

Scope

No merge or deployment performed.

[github-actions]

Deep review — #439 web: remove stale vulnerable npm lockfile

Thanks for this — it's a clean, well-documented piece of hygiene. The PR deletes the orphaned web/package-lock.json (which pinned the vulnerable Next.js 16.2.6) and corrects the audit note now that web/bun.lock is the single web lockfile. I verified the claims against the checkout and they hold up.

Summary

The web/ surface is a bun project: web/README.md documents bun install / bun dev / bun run build exclusively, web/package.json declares next@16.3.4, and web/bun.lock resolves next@16.3.4. The npm lockfile was stale (16.2.6) and unused, so it was pure drift + a vulnerable pin. Removing it is the right call.

Alignment

Firmly in scope. This is bug-fix / hygiene work on the web/ surface, plus a notes/** doc correction — both in-bounds under the policy, nothing near the "unopinionated / tenant-config" or upstream-divergence tripwires.

Findings

No blocking issues. Verification notes:

1. No consumer of the deleted file exists — (confirmed, no action). CI's web-typecheck job (.github/workflows/ci.yml:82-94) runs under working-directory: web with bun install --frozen-lockfile + bun tsc --noEmit; it never touches package-lock.json. No web/vercel.json, no npm ci/npm install against web/ anywhere in workflows, and the only repo-root npm install (CONTRIBUTING.md:31, the gitignored vercel CLI) is unrelated. Deleting the file is inert to the build.

2. Dependabot config is correct as-is — (confirmed, no action). .github/dependabot.yml:15-25 watches package-ecosystem: "bun" in /web, so leaving it unchanged is right; there's no npm ecosystem entry to remove.

3. The note edit is accurate — (confirmed). notes/c11-audit-20260609.md:184 previously flagged the dual-lockfile drift; after this PR one bun lockfile remains and Dependabot follows it, so the rewritten line reflects reality.

4. Aside for the maintainer (not a change request): the Drawbridge deny-list in TRIAGE_POLICY.md covers **/*.lock, **/Package.resolved, and **/bun.lockb, but not package-lock.json (or yarn.lock). This PR escalated correctly anyway — the 8001-line deletion blows past the 500-line size cap — so it's not a gap that mattered here. But a small future npm-lockfile change could slip the autonomous lane. Worth a one-line addition (**/package-lock.json, **/yarn.lock) if you want lockfiles uniformly gated. Purely optional and out of this PR's scope.

No prompt-injection or suspicious content in the diff or discussion.

Recommendation

Merge as-is. Correct, well-scoped, and the removal closes the open Dependabot alerts on the vulnerable transitive pin with no build impact. Nice cleanup.

---

🌉 Drawbridge deep review (lane 3) — an automated pass; a maintainer has been notified and makes the final call.