ci: run the dependency audit as its own job

`npm audit` consults live advisory data, so it can begin failing without any
change to this repository. As a step inside the `test` job it short-circuited
every later step, including the bundle drift check.

That is not hypothetical: when undici was bumped in #12, the audit step was
already failing on unrelated advisories, so `Check bundled action` never ran
and a stale `dist` bundle went undetected on main for roughly twelve hours.
undici is a production dependency inlined into dist/index.js, so the bundle
had genuinely drifted from the lockfile.

Splitting audit into its own job keeps both signals independent: a newly
published advisory no longer suppresses the build, lint, test, or drift
checks, and each failure is attributable on its own.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: alchemydc

.github/workflows/ci.yml

@@ -44,8 +44,13 @@ jobs:
         with:
           fail-on-severity: moderate
 
-  test:
-    name: Test
+  # Audit runs as its own job rather than as a step in `test`. npm audit
+  # consults live advisory data, so it can start failing without any change to
+  # this repository. As a step it short-circuited every later step, which once
+  # hid a stale `dist` bundle for hours. Keep it independent so the bundle check
+  # below always reports.
+  audit:
+    name: Audit
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -65,6 +70,24 @@ jobs:
       - name: Audit dependencies
         run: npm audit --audit-level=moderate
 
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
       - name: Check formatting
         run: npm run format:check