docs: dependency-security decision memo — the 56 Dependabot alerts

[ronaldtse]

Analysis of the 56 open Dependabot alerts (4 critical / 20 high / 18 moderate / 14 low) — a decision memo, not a fix: every remediation path changes a version/requirements contract, which is the owner call (python/pyproject.toml documents the weights-coupling gate).

Findings:

• All alerts target python/{arabic,hebrew}/requirements.txt (frozen 2021 pins: torch==1.9.0, onnx==1.9.0, numpy==1.19.5, tqdm==4.56.0) plus the root pyproject floors. interscript-ml and the site have zero alerts.
• The re-validation gate is REAL: PRs Bump torch from 1.9.0 to 2.13.0 in /python/hebrew #52/Bump torch from 1.9.0 to 2.13.0 in /python/arabic #53 (torch -> 2.13.0) fail the Ruby matrix with diacritize_text golden mismatches — legacy CBHG weights behave differently under new torch. Meanwhile python-arabic CI (eager upgrade) is green at latest — only the Ruby-bridge goldens are numerics-pinned.
• Options tabled in TODO.publish/06: (A) keep frozen + dismiss legacy-file alerts (matches the eager-CI validation posture; my read), (B) merge Bump onnx from 1.9.0 to 1.22.0 in /python/arabic #51-53 + re-record goldens (silently redefines legacy model output), (C) raise root floors (cuts torch<2.6 consumers).
• Fixed alongside: dangling TODO.complete/19-torch-2x.md pointer in python/pyproject.toml (file never existed in-repo); register 05 refreshed with resolved items (E6 closed failed, glm-4.7 row complete).