Add dependency vulnerability gate to CI

[NickCrew]

Description

GitHub Dependabot flagged 31 vulnerabilities on the default branch (5 high, 20 moderate, 6 low) — visible only in git push remote messages, not in CI. There is no PR-time vulnerability gate. Two complementary mechanisms to consider: (1) actions/dependency-review-action on PRs to flag newly-introduced vulns from a diff, fail-on-severity high; (2) pnpm audit --audit-level=high step in signal-horizon-quality.yml as periodic check. For Cargo, cargo audit covers the same surface for the WAF. Start informational (continue-on-error) so existing high vulns don't immediately block all PRs, then triage the backlog and flip to gating once the queue is drained.

Acceptance Criteria

• Migrate synapse-waf to Rust 2024 edition #1 actions/dependency-review-action wired into PR workflow with fail-on-severity: high (or moderate) once existing backlog is triaged
• Cache parsed EvalContext data across body-phase and deferred WAF passes #2 pnpm audit --audit-level=high step added to signal-horizon-quality.yml (informational at first, gating after triage)
• Instantiate and integrate HeaderProfiler for per-endpoint header anomaly detection #3 cargo audit step added to the new synapse-waf-quality.yml (depends on TASK-101)
• Escalate invalid-session weight non-linearly to catch faster brute-force #4 Existing 31-vuln backlog is triaged: each high CVE has a tracking task or upgrade plan; remaining acceptable risks documented

---

Migrated from backlog TASK-102 (synapse).