[SEC-004] Harden devdocsai-js package security and provenance

[Wentzel-DevDocs]

Summary

• Add docs/compliance/package-security-provenance.md as the SEC-004 package security and provenance baseline.
• Document npm publishing controls, token handling, package integrity, provenance target state, SBOM/dependency evidence, CI gates, release workflow, explicit gaps, evidence artifacts, and exact verification commands.

Validation

• npm ci completed successfully; npm reported existing audit findings during install.
• npm run lint passed after formatting the new Markdown document.
• npm run test passed: 17 test files, 143 tests.
• npm run build passed; generated .tgz pack artifacts were removed before commit.

Blockers

• None.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ca11be91-e9d5-44ac-a0fa-eeb5f97c3a32

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/sec-004-devdocsai-js-package-provenance

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}