Problem

The Security Audit step in Checks and Tests (bun audit --audit-level high) has been failing on main, blocking CI. Two new high-severity advisories:

• tmp <0.2.6 (via patch-package › tmp) — Path Traversal (GHSA-ph9p-34f9-6g65)
• axios >=1.0.0 <1.16.0 (via tests/test-build-unified) — 6 high advisories (NO_PROXY bypass, proxy MITM via prototype pollution, ReDoS, proxy-auth credential leaks)

Fix

• Bump axios in tests/test-build-unified from ^1.7.0 → ^1.17.0 (resolves to 1.17.0)
• Add tmp: 0.2.7 to root resolutions — consistent with the existing security pins there (minimatch, node-forge, cross-spawn, got, …). Forces the safe tmp regardless of which transitive dep pulls it in.

Verification

• bun audit --audit-level high --ignore GHSA-3ppc-4f35-3m26 → exit 0, no vulnerabilities
• manypkg check → workspaces valid
• Lockfile resolves axios@1.17.0, tmp@0.2.7