fix(telemetry): scope-ignore unreachable esbuild advisories

wrangler pins esbuild exactly (0.27.3) and even wrangler@4.100.0 has
not adopted the patched 0.28.1 line, so no in-range update can clear
GHSA-gv7w-rqvm-qjhr (high, Deno-only binary integrity — this worker
builds on Node) or GHSA-g7r4-m6w7-qqqr (low, esbuild dev server on
Windows — never started here). Ignore both via auditConfig in
pnpm-workspace.yaml with removal trigger documented in README:
drop the entries when wrangler ships esbuild >=0.28.1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bradheitmann

telemetry/README.md

@@ -109,3 +109,19 @@ Telemetry is opt-in at every layer: install of the npm package does
 nothing; the user must deploy this Worker themselves; the client must
 set `ODIN_TELEMETRY_ENDPOINT`; and EXEC PM must explicitly call
 `odin.submit_session_report` with user-approved content at session close.
+
+## Security audit exceptions
+
+`pnpm-workspace.yaml` ignores two esbuild advisories that are
+unreachable in this workspace (esbuild arrives only as wrangler's
+bundled build tool, pinned exactly by wrangler upstream):
+
+- `GHSA-gv7w-rqvm-qjhr` (high) — missing binary integrity verification
+  when esbuild is installed through **Deno**. This workspace runs
+  wrangler on Node only.
+- `GHSA-g7r4-m6w7-qqqr` (low) — arbitrary file read in the esbuild
+  **dev server on Windows**. The dev server is never started here;
+  `wrangler dev` is local-only development on macOS/Linux.
+
+Remove both entries when wrangler ships esbuild >= 0.28.1
+(check with `pnpm view wrangler@latest dependencies.esbuild`).

telemetry/pnpm-workspace.yaml

@@ -5,3 +5,11 @@ allowBuilds:
 
 overrides:
   ws: 8.20.1
+
+# Both esbuild advisories are unreachable here: esbuild is wrangler's
+# bundled build tool (Node-only; the high is Deno-specific, the low is
+# the dev server on Windows). Remove when wrangler ships esbuild >=0.28.1.
+auditConfig:
+  ignoreGhsas:
+    - GHSA-gv7w-rqvm-qjhr
+    - GHSA-g7r4-m6w7-qqqr