docs(governance): close sprint 5 with merge and validation evidence

[simonhagger]

Summary

• What changed:
  • Added Sprint 5 progress-log closure entry to \docs/05-governance/current-sprint.md\ recording PR Sprint 5 gateway baseline and dependency refresh #14 merge (\main\ @ \�2911ee) with run \32520564986\ all checks green.
  • Documented dependency-security closeout delivered inside PR Sprint 5 gateway baseline and dependency refresh #14: pnpm-honored overrides for \js-yaml/\immutable\ (scoped to vulnerable ranges), stale @angular/core@21.2.9\ lockfile resolutions deduped, phantom \�lectron-updater\ import declared explicitly, \pnpm audit --prod\ reporting no known vulnerabilities.
  • Recorded removal of the unused Azure Static Web Apps workflow that failed permanently on every pull request.
• Why this change is needed:
  • Keep governed delivery records consistent with realised state; Sprint 5 exit criteria are now demonstrably met.
  • Preserve audit trail of supply-chain hardening root causes (npm-style overrides ignored by pnpm; duplicate manifest key dropping Electron build allowlist).
• Risk level:
  • Low (documentation-only change; no code or workflow modifications)

Change Groups

• Governance:
  • Progress-log closure entry in current sprint record with concrete validation evidence (check-run id, audit result).

Validation

• \pnpm docs-lint\

Engineering Checklist

• Conventional Commit title used
• Unit/integration tests added or updated (N/A — documentation-only)
• A11y impact reviewed (N/A — documentation-only)
• I18n impact reviewed (N/A — documentation-only)
• IPC contract changes documented (N/A — no contract changes)
• ADR added/updated for architecture-level decisions (N/A — no architecture decision)

Security (Required For Sensitive Changes)

• Security review completed
• Threat model updated or N/A explained
• Confirmed no secrets/sensitive data present in committed files

Security Notes

• Threat model link/update:
  • N/A for this increment (documentation-only governance record).
• N/A rationale:
  • No executable code, workflow, contract, or trust-boundary changes; entry references already-reviewed and merged work from PR Sprint 5 gateway baseline and dependency refresh #14.