ci: dependabot title exemption, dependency floors, secret-backed account id

Phase C of the OSS-ready program:

- static-checks: the 72-character PR-title ceiling no longer applies to
  dependabot[bot] (machine-generated titles grow with group size and are not
  configurable; the Conventional-Commits pattern still applies to everyone;
  commitlint's own ceiling is 100)
- dependency floors: dompurify override advanced to 3.4.12; body-parser
  floored to 2.3.0 (resolved 2.2.2 was inside the advisory range via express
  and @modelcontextprotocol/sdk paths)
- deploy-cloudflare reads CLOUDFLARE_ACCOUNT_ID from secrets (masked in
  public logs; the secret already exists, the variable is removed after the
  next validated deploy)
- build-snapshot environment casing normalized to Production
- sandbox Dockerfile documents that alerts #9/#8 are lockfile-metadata
  findings mitigated by the runtime-security-overrides overlay

Author: iamjr15

.github/workflows/build-snapshot.yml

@@ -24,7 +24,7 @@ jobs:
   build-snapshot:
     runs-on: ubuntu-24.04
     timeout-minutes: 60
-    environment: production
+    environment: Production
     steps:
       - name: Authorize snapshot publication
         env:

.github/workflows/deploy-cloudflare.yml

@@ -70,5 +70,5 @@ jobs:
               --var "CHEATCODE_RELEASE_SHA:$GITHUB_SHA"
           done
         env:
-          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

.github/workflows/static-checks.yml

@@ -38,21 +38,24 @@ jobs:
       - name: Validate pull request title
         if: github.event_name == 'pull_request'
         env:
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           python3 - <<'PY'
           import os
           import re
 
+          author = os.environ["PR_AUTHOR"]
           title = os.environ["PR_TITLE"]
           pattern = re.compile(
               r"(?:build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)"
               r"(?:\([a-z0-9][a-z0-9._/-]*\))?!?: \S.*"
           )
-          if len(title) > 72 or pattern.fullmatch(title) is None:
-              raise SystemExit(
-                  "Pull request titles must use Conventional Commits and be at most 72 characters."
-              )
+          if pattern.fullmatch(title) is None:
+              raise SystemExit("Pull request titles must use Conventional Commits.")
+          # Dependabot titles are machine-generated from group/directory names, grow past 72 chars, and are not configurable; commitlint's own ceiling is 100.
+          if len(title) > 72 and author != "dependabot[bot]":
+              raise SystemExit("Pull request titles must be at most 72 characters.")
           PY
 
       - name: Classify changed files

infra/containers/sandbox/Dockerfile

@@ -35,6 +35,7 @@ COPY package-manager/package.json package-manager/package-lock.json /opt/cheatco
 COPY doc-runtime/package.json doc-runtime/package-lock.json /opt/cheatcode-doc-runtime/
 # npm, pnpm, and code-server ship their own dependency trees, so ordinary
 # top-level overrides cannot replace vulnerable packages inside those bundles.
+# Dependabot alerts #9 (brace-expansion) and #8 (tar) are lockfile-metadata findings mitigated by this overlay because npm has not re-bundled the fixed versions.
 COPY runtime-security-overrides/package.json runtime-security-overrides/package-lock.json /opt/cheatcode-runtime-security-overrides/
 COPY skill-runtime/package.json skill-runtime/package-lock.json skill-runtime/tsconfig.json /opt/cheatcode-skill-runtime/
 COPY skill-runtime/bin/ /opt/cheatcode-skill-runtime/bin/

pnpm-lock.yaml

@@ -49,7 +49,8 @@ overrides:
   '@tootallnate/once@>=2.0.0 <2.0.1': 2.0.1
   '@vercel/node@5.8.25>undici': 6.27.0
   'ajv@>=8.0.0 <8.18.0': 8.20.0
-  'dompurify@<=3.4.10': 3.4.11
+  'body-parser@>=2.0.0 <2.3.0': 2.3.0
+  'dompurify@<=3.4.11': 3.4.12
   'fast-uri@<3.1.4': 3.1.4
   'js-yaml@<3.15.0': 3.15.0
   'js-yaml@>=4.0.0 <4.3.0': 4.3.0