ci: enforce safe NAPI artifact consumers

[BartWaardenburg]

Summary

• route coverage, benchmarks, README, and contributor setup through the no-js NAPI bootstrap
• enforce the safe bootstrap across direct, filtered, and package-local command variants
• hold only memchr 2.8.3 in Dependabot after its performance regression
• remove completed planning and design artifacts

Verification

• policy tests verified red then green for every unsafe invocation family
• Dependabot YAML parsed successfully
• full NAPI and WASM artifact bootstrap passed
• tracked NAPI loaders remained unchanged
• pnpm check passed
• pnpm test passed
• independent review found no remaining issues

[codspeed-hq]

Merging this PR will degrade performance by 45.1%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 3 regressed benchmarks
✅ 185 untouched benchmarks
⏩ 76 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	real_world_lookup_single[Preact] srcmap WASM buf	31.4 µs	81.8 µs	-61.62%
❌	real_world_lookup_single[Preact] srcmap WASM flat	51.7 µs	103 µs	-49.78%
❌	real_world_lookup_single[Preact] source-map-js	286.2 µs	333.4 µs	-14.14%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing codex/safe-artifact-consumers (ea981f3) with main (db0d877)}

Footnotes

1. 76 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩