Image uploads stay secure by default

The image pipeline moved to the current reviewed Sharp release, while dependency security became a universal release gate instead of a check that could depend on which files changed.

• Every release lane runs a production-only dependency audit before Railway can change.
• Hosted CI enforces the same high-and-critical advisory boundary.
• Shared-runner timing remains observational where hardware cannot be compared fairly, while the reviewed local performance gate stays blocking.