chore(ci): enable-audit is a no-op since npm retired the audit endpoint

[BryanFRD]

Problem

.github/workflows/ci.yml passes enable-audit: true to the reusable Node workflow. npm retired the legacy audit endpoints on 2026-07-15, and pnpm audit has no working replacement until pnpm 11 — the gate cannot report a real advisory today.

Why it matters

A dependency-audit step that structurally cannot fail is worse than no step: the CI summary shows a green audit on every PR, so the repo reads as "dependencies are checked" when nothing is being checked. @ferrlabs/mcp-core and the five servers are published to npm, so a real supply-chain regression here reaches users.

Related context: issue #208 already dealt with a hono audit advisory breaking CI on main, so the flag has a history in this repo.

Proposed approach

• Confirm the current behaviour of the shared workflow — whether it now warns instead of failing, and whether the flag does anything at all.
• If it is a no-op, either turn it off until pnpm 11 lands so the green check is honest, or repoint it at a source that works (the GitHub advisory database via Dependabot alerts, or osv-scanner on the lockfile).
• Whichever way, the state should be legible from the workflow file rather than requiring someone to know about the endpoint retirement.

Acceptance criteria

• The audit step either performs a real check or is visibly disabled with a reason.
• A known-vulnerable dependency added to the lockfile is caught by whatever replaces it.