fix(release): surface companion build and secure GitWorkshop deps

docs/1.8.12-RELEASE-PLAN.md

@@ -46,12 +46,19 @@ publication.
 - The release-root signer exists locally as a binary, while its mnemonic
   remains correctly offline.
 - ISO dependencies (`xorriso`, `mksquashfs`, and QEMU) are installed.
-- The corrected release gate passed on 2026-09-11: 1,091 frontend tests,
+- The corrected release gate passed on 2026-09-11: 1,093 frontend tests,
   production UI build, registry candidate/trust checks, Rust check, 114 focused
   backend tests plus orchestration, and live dashboard/AIUI/RPC probes. Android
   lint and the mobile Chromium signer-handoff regression also pass.
+- GitWorkshop's refreshed dependency lock reports zero production or
+  development npm advisories. Its type-check, all 152 unit tests, and exact
+  Archipelago subpath production build pass with `fflate` 0.8.3, React Router
+  7.18.3, and Vitest 5.0.0.
 - The locally served Companion candidate is 28,157,847 bytes with SHA-256
   `30e0b6257f17bb5e072941ccce6fde04b6c8ae59a49b45169e1920aec1b108cf`.
+- The Discover banner and automatic Companion prompt read that artifact's
+  no-cache metadata, display 0.5.32 build 52, and remember dismissal per build;
+  the ISO gate derives the same expected version from the Android project.
 - The owner accepted the risk of redistributing the pinned, unlicensed
   GitWorkshop revision on 2026-09-11. `NOTICE` and `UPSTREAM.md` disclose that
   decision without claiming an upstream license.
@@ -70,10 +77,6 @@ publication.
   reachable in an existing public Git branch. It provides upgrade continuity,
   not production authenticity. A future production Companion must use the
   `com.archipelago.app` package with a privately held release key.
-- The pinned GitWorkshop revision has 4 high and 6 moderate production npm
-  advisories. The final image is static nginx, reducing exposure to Node-server
-  advisories, but browser dependencies remain reachable. Release requires an
-  owner accept/fix decision.
 - The repository is large: this checkout has about 5.4 GiB of packed objects,
   and the Gitea repository is about 5 GiB. Public GRASP replication must be
   allowed enough time and verified rather than assumed complete.
@@ -93,9 +96,7 @@ committed, placed in shell history, or stored on the node:
    nsec on a command line.
 2. The 24-word Archipelago release-master mnemonic for three signing actions:
    the OTA manifest, the app catalog, and the ISO checksum document.
-3. A decision to accept the recorded GitWorkshop dependency advisories for
-   1.8.12-alpha or pause for a dependency update.
-4. A decision to publish 0.5.32 on the existing explicitly non-production
+3. A decision to publish 0.5.32 on the existing explicitly non-production
    `.debug` Companion channel, omit it, or pause for a secure production-app
    signing ceremony.