Releases 0.18.7 → 0.18.10 finally ship — CI was silently failing for 4 days on a deps audit

What shipped

• •CI's `npm audit --omit=dev --audit-level=high` was failing on 32 high + 1 critical vulnerabilities, all traceable to one dependency tree: html-minifier (unmaintained, REDoS regex DoS bug) → mjml-core → every mjml-* sub-package → mjml. The audit had been failing since the 28 April release was attempted.
• •Fix: bumped mjml from ^4.18.0 to ^5.1.0 (which uses a different minifier and drops html-minifier entirely) plus npm audit fix for the lodash + protobufjs + ip-address vulns. Verified non-breaking: all 78 tests pass, including the full email-pipeline suite that uses mjml.
• •All features from the four undeployed releases now ship in this build: the Stripo native API integration (orbit_setup_stripo / orbit_sync_stripo_modules / orbit_list_stripo_modules / orbit_document_stripo_design_system / orbit_compose_stripo_email), the orbit_audit_stripo_modules + orbit_fix_stripo_module pair for catching and correcting saved-module structural issues, the orbit_braze_performance fix for scheduled-blast canvases, and the MCP server lifecycle handlers that stop zombie processes accumulating after Claude Desktop quits.
• •Lesson tucked away in our internal runbook: the website's LATEST_MCPB_VERSION constant auto-syncs from the live S3 manifest every 15 minutes, but if CI never uploads to S3 the website silently stays on the previous version. A 'CI passed but version sync didn't tick' alarm would have caught this on day one rather than day four. Future improvement.