[stack 37/39] Remediate docs-site dependency baseline

[sarthakagrawal927]

Summary

• pin patched transitive docs-site dependencies while retaining Blume as the sole direct dependency
• reduce the independent docs-site production audit from 28 advisories to two unpatched image-size findings
• document residual reachability containment and remove the stale legacy gateway configuration claim

Verification

• pnpm --dir docs-site install --frozen-lockfile
• pnpm --dir docs-site run build (61 pages)
• node scripts/check-docs.mjs (86 Markdown files)
• pnpm exec biome check docs-site/package.json
• pnpm --dir docs-site audit --json (2 high, 0 critical/moderate/low; both unpatched upstream)
• no .icns, .jxl, .heif, or .heic inputs under docs/ or docs-site/

Stack

Layer 37 of 38. Base: #240. Draft only; do not merge or release until owner approval.

Tracks #194 and #195.