ci(audit): scope decky to shipped deps; make docs-site non-blocking deterministically

First real-runner dispatch (run 13627) surfaced two calibration issues:
* pnpm audit flagged 6 high advisories — all in decky's devDependencies
  (the rollup build toolchain), which never ship: the plugin bundle carries
  prod deps only. --prod scopes the gate to what users get, matching the
  locally-validated state (clean).
* docs-site relied on job-level continue-on-error, which act_runner does
  not reliably honor — replaced with a step-level '||' warning so the known
  advisories can never take the run red while staying visible in the log.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/audit.yml

@@ -85,13 +85,14 @@ jobs:
         run: bun audit
 
   # Kept OUT of the bun-audit matrix so this tree's known-advisory state can't normalize failure
-  # in a shipping tree. See the header for why this one is non-blocking.
+  # in a shipping tree. Non-blocking via a step-level `||` (NOT job-level continue-on-error, which
+  # act_runner does not reliably honor — a red job here would take the whole run red). The full
+  # advisory list still lands in the log; the warning marks it wasn't clean.
   docs-site-audit:
     runs-on: ubuntu-24.04
     container:
       image: oven/bun:1
     timeout-minutes: 15
-    continue-on-error: true
     defaults:
       run:
         working-directory: docs-site
@@ -101,7 +102,7 @@ jobs:
         run: apt-get update && apt-get install -y --no-install-recommends ca-certificates git
       - uses: actions/checkout@v4
       - name: bun audit (non-blocking)
-        run: bun audit
+        run: bun audit || echo "::warning::docs-site has known advisories (CMS/UI + nitropack chains) — tracked in punktfunk-planning design/cra-readiness.md"
 
   pnpm-audit:
     runs-on: ubuntu-24.04
@@ -115,10 +116,13 @@ jobs:
       - uses: actions/checkout@v4
       # decky is pnpm-managed (pnpm-lock.yaml lockfileVersion 9.0 → pnpm 10 reads it). Like
       # bun audit, `pnpm audit` needs no install/build — lockfile + registry advisory DB only.
+      # --prod: rollup bundles only the prod deps into the shipped plugin; devDependencies are
+      # build tooling that never leaves CI (auditing them fails on toolchain advisories that
+      # can't reach a user — the docs-site problem in miniature).
       - name: pnpm audit
         run: |
           npm install -g pnpm@10
-          pnpm audit
+          pnpm audit --prod
 
   # The regression guard about.toml documents: fail if any crate in either Rust workspace carries
   # a license outside the `accepted` allowlist (e.g. a copyleft dep silently entering the linked