Node.js security starts before CI

In many teams, dependency security still happens after the most important trust decision has already been made. A package is added, the lockfile changes, the feature moves forward, and only later does the pipeline ask whether the application should have trusted that code in the first place. That workflow made sense when dependency security was mostly viewed as a compliance check.