fix(docs): retain patched compatible JSON 2.x

[dependabot]

Rework JSON hardening into the compatible bound >=2.21.2,<3, keeping locked JSON 2.21.2 and Jekyll 4.4.1. Update the existing security-floor check; defer incompatible JSON 3 migration.

Native stack #757: dev <- #744 <- #727 <- #752 <- #754 <- #753. This PR retains its number and original dependency branch; its signed final head is 22390602c60a6617467eada077673a27f8289c19, tree 6bb21c18a7a3b956c277b0dece19210e8ae882ba. The protected root is merged prerequisite #758 at 30f98cc14e074802a9f21c6b84e69e743eee6442; organization policy #3 is merged.

All required checks pass and GitHub reports CLEAN on this exact head (verified 11 October 2026 Europe/Berlin). Ordinary CI and all three native Requirements jobs pass. The unedited exact-head/tree member grant was posted by djm81; protected Requirements authority passes. No unresolved review threads remain.

The floor control fails before declaration changes, then all 17 documentation-script controls pass. Conservative Bundler regeneration changes the bound without downgrading Jekyll or introducing unrelated package/platform changes.

The complete native plan sha256:94e049b71b00de0d52b4afa8b7ce9b08729bc97ae5ae379db1682af179125461 is identical across all five final heads. Fresh authored RED 38119009577 precedes the implementation; mapped test bytes remain unchanged. Each final head independently retains passing producer/consumer JUnit, verified lifecycle, complete plan equality and original RED provenance. Historical #756 evidence is preserved.

Full assembled local smart testing: 3,291 passed, 9 existing skips, 2 warnings in 179.08 seconds; unchanged 64% coverage. Frozen parity, all three Python audits, trust/licenses/Socket, independent SAST, strict signatures, version/PyPI-ahead, Python 3.11-3.13 runtime/wheel checks and repository quality gates pass. Each head's two normalized installed inventories contain the same 180 package identities and its paired SPDX SBOMs are byte-identical; authoritative typing has zero errors with 1,522 existing warnings. The full changed-Python SpecFact review has zero errors/new regressions; its 21 unchanged fixture warnings and 3 information findings retain the narrow documented baseline exceptions in TDD_EVIDENCE.md.

Leave all five dependency PRs unmerged as requested. Broader inventory and JSON 3 migration remain deferred under open #747; #748 is a dated planning follow-up outside this stack. No tag or release is published. Exact grants expire 2026-10-13T07:04:26Z; head/tree/base changes require fresh validation and grants.

Promotion: merge the reviewed native stack normally; validate the integrated dev-to-main SHA with required Requirements/signature/quality/security gates, 0.55.6 source/artifact parity, strict live PyPI-ahead and both documentation deployment paths. Archive completed prerequisite tracking and clean worktrees after reviewed integration; retain the broader active change while accepted work remains. Rollback refs preserve original and intermediate heads; use explicit leases for unmerged branches or a normally reviewed revert for merged prerequisites. Never reset protected shared history.

Refs #747. OpenSpec: dependency-update-consolidation.

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 48 pull requests across this workspace.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: nold-ai/specfact-cli/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: cede5544-6de2-417e-8236-8a4dd7bc1067

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 20.63s
Checks: 4 total (3 passed) (1 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 16.67s
Checks: 4 total (3 passed) (1 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 25.55s
Checks: 4 total (3 passed) (1 skipped)

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 15.36s
Checks: 4 total (3 passed) (1 skipped)

[djm81]

SPECFACT_TRUSTED_REQUIREMENTS_AUTHORITY_V1
{"authority_version":1,"base_ref":"dependabot/pip/development-security-updates-e660df2248","capability":"trusted-requirements-authority","expires_at":"2026-10-13T06:55:47Z","head_branch":"dependabot/bundler/docs/json-3.0.2","head_commit":"97413d3a060a7028af46eacbf1359dccf03e5247","head_tree":"db794714720314e89429757530ad0f7c3cfd2d05","pull_request":727,"repository":"nold-ai/specfact-cli","signer_login":"djm81"}

[djm81]

SPECFACT_TRUSTED_REQUIREMENTS_AUTHORITY_V1
{"authority_version":1,"base_ref":"dependabot/pip/development-security-updates-e660df2248","capability":"trusted-requirements-authority","expires_at":"2026-10-13T07:04:26Z","head_branch":"dependabot/bundler/docs/json-3.0.2","head_commit":"22390602c60a6617467eada077673a27f8289c19","head_tree":"6bb21c18a7a3b956c277b0dece19210e8ae882ba","pull_request":727,"repository":"nold-ai/specfact-cli","signer_login":"djm81"}

[github-actions]

SpecFact CLI Validation Report

✅ All validations passed!
Duration: 26.28s
Checks: 4 total (3 passed) (1 skipped)