fix(16): CR-01 enforce audit-waiver expiry; IN-01 realpath isMain

Add isWaived() predicate: a waiver with a past 'expires' date is treated
as absent so the High/Critical advisory re-blocks. Applied in both
selectBlocking and partitionAdvisories. Add expired-waiver unit tests.
isMain now compares fully-resolved real paths (mirrors index.ts).

scripts/__tests__/check-audit.test.mjs

@@ -10,7 +10,7 @@
 
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import { selectBlocking, partitionAdvisories } from '../check-audit.mjs';
+import { selectBlocking, partitionAdvisories, isWaived } from '../check-audit.mjs';
 
 // Fixture: a High advisory not in the allowlist
 const highUnwaived = {
@@ -59,6 +59,23 @@ const allowlist = {
 
 const emptyAllowlist = {};
 
+// Fixture: allowlist whose esbuild waiver has already expired (CR-01).
+const expiredAllowlist = {
+  'GHSA-gv7w-rqvm-qjhr': {
+    reason: 'esbuild dev transitive — not in production runtime',
+    reviewer: 'luc',
+    expires: '2000-01-01',
+  },
+};
+
+// Fixture: allowlist with no expiry field (waives indefinitely).
+const noExpiryAllowlist = {
+  'GHSA-gv7w-rqvm-qjhr': {
+    reason: 'esbuild dev transitive — not in production runtime',
+    reviewer: 'luc',
+  },
+};
+
 test('unwaived High advisory is blocking', () => {
   const blocking = selectBlocking(highUnwaived, emptyAllowlist);
   assert.equal(blocking.length, 1);
@@ -86,3 +103,24 @@ test('partitionAdvisories splits blocking and advisory correctly', () => {
   assert.equal(blocking.length, 1);
   assert.equal(advisory.length, 2);
 });
+
+test('expired waiver is treated as absent — High advisory re-blocks (selectBlocking)', () => {
+  const blocking = selectBlocking(highWaived, expiredAllowlist);
+  assert.equal(blocking.length, 1);
+  assert.equal(blocking[0].github_advisory_id, 'GHSA-gv7w-rqvm-qjhr');
+});
+
+test('expired waiver is treated as absent — High advisory re-blocks (partitionAdvisories)', () => {
+  const { blocking, advisory } = partitionAdvisories(highWaived, expiredAllowlist);
+  assert.equal(blocking.length, 1);
+  assert.equal(advisory.length, 0);
+  assert.equal(blocking[0].github_advisory_id, 'GHSA-gv7w-rqvm-qjhr');
+});
+
+test('isWaived: future expiry waives, past expiry does not, missing entry does not', () => {
+  const adv = { severity: 'high', github_advisory_id: 'GHSA-gv7w-rqvm-qjhr' };
+  assert.equal(isWaived(adv, allowlist), true); // future expiry (2026-09-01)
+  assert.equal(isWaived(adv, expiredAllowlist), false); // past expiry
+  assert.equal(isWaived(adv, noExpiryAllowlist), true); // no expiry → indefinite waive
+  assert.equal(isWaived(adv, emptyAllowlist), false); // not listed
+});