chore(deps): upgrade both sites to Astro 7

.github/workflows/ci.yml

@@ -21,11 +21,16 @@ jobs:
       # The vendored OpenAPI spec is a copy of the engine's. Without the source
       # beside it there is nothing to compare against, and a drift check that
       # cannot see the source is a check that always passes.
+      #
+      # Full history, because the check reads the spec at the commit recorded in
+      # openapi-source.json rather than at whatever is currently on main. See
+      # that script's header for why the pin exists.
       - name: Checkout dpp-engine (source of the vendored API spec)
         uses: actions/checkout@v4
         with:
           repository: odal-node/dpp-engine
           path: .dpp-engine
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Enable Corepack
@@ -62,3 +67,31 @@ jobs:
         run: pnpm run check:openapi
         env:
           DPP_ENGINE_DIR: ${{ github.workspace }}/.dpp-engine
+
+      # Reports, without failing, how far the pin is behind the engine's main.
+      # Deliberately not a gate: the pinned copy being *correct* is this repo's
+      # problem and is enforced above, but the pin being *old* is a release-
+      # cadence judgement, and failing on it would redden every pull request
+      # here every time the engine merges anything. The number is printed on
+      # every run so the drift that started this — a published spec fifteen
+      # endpoints behind, with nothing to reveal it — cannot go unnoticed again.
+      - name: Report how far the API-spec pin is behind
+        if: always()
+        run: |
+          PIN=$(node -p "require('./site/dpp-docs/openapi-source.json').commit")
+          cd .dpp-engine
+          BEHIND=$(git rev-list --count "$PIN"..origin/main -- api/openapi.yaml 2>/dev/null || echo "?")
+          if [ "$BEHIND" = "0" ]; then
+            echo "API spec pin is current with the engine's main branch."
+          else
+            echo "::notice::The vendored API spec is pinned $BEHIND commit(s) behind changes to api/openapi.yaml on the engine's main. Run 'pnpm run sync:openapi' to bring it forward."
+            git --no-pager log --oneline "$PIN"..origin/main -- api/openapi.yaml || true
+          fi
+
+      # Fails on a high-severity advisory. The remaining advisories are all
+      # build-time or dev-server issues in transitive dependencies, which do not
+      # reach a static deploy — so this is set to fail on `critical` today and
+      # should be tightened to `high` once those clear. The point is that a new
+      # advisory becomes visible on the pull request that introduces it.
+      - name: Audit dependencies
+        run: pnpm audit --audit-level critical