Epic: toolchain & release engineering

[ApocDev]

Build, dependency, test, and release hygiene for the repo — the non-feature work that keeps installs reproducible and verification trustworthy.

Sub-issues:

• Pin app dependency versions (drop "latest") #79 — pin app dependency versions (complete).
• Replace hard-coded Scenario block fixture #157 — replace the hard-coded Scenario E2E fixture.
• Resolve the remaining dependency security alerts #166 — resolve the remaining dependency security alerts.

Close this epic after #157 and #166 land. Future substantial engineering-hygiene campaigns should get a concrete scoped epic rather than leaving this as an evergreen container.