Studio: harden install-script gate against PR self-allowlist

Three findings against the install-script allowlist landed by the
HTML/SVG preview PR:

1. Allowlist matched on package name alone, so adding 'esbuild'
   silently approved every future esbuild postinstall version. Pin
   each entry to name@version and reject bare names.

2. The script defaulted the allowlist path to the head checkout's
   .install-script-allowlist, so the same PR that introduced a new
   postinstall dep could allowlist it in the same diff. Source the
   allowlist from the BASE ref instead; any head-only entry fails
   the gate.

3. The security-audit workflow only extracted the BASE package-lock,
   leaving the allowlist defaulted to the PR checkout. Update the
   workflow to also extract the BASE allowlist and pass it through
   --base-allowlist.

The existing esbuild entry is now pinned to esbuild@0.21.5 so the
gate refuses any future esbuild version that has not been
re-eyeballed.

.github/workflows/security-audit.yml

@@ -1096,20 +1096,27 @@ jobs:
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
 
-      - name: Extract base-ref lockfile (PR triggers only)
+      - name: Extract base-ref lockfile and install-script allowlist (PR triggers only)
         if: github.event_name == 'pull_request'
         run: |
           set -e
           BASE_SHA="${{ github.event.pull_request.base.sha }}"
           git show "$BASE_SHA:studio/frontend/package-lock.json" \
             > /tmp/base-package-lock.json
+          # Pull the TRUSTED allowlist from the base ref so a PR cannot
+          # allowlist its own new postinstall dependency in the same diff
+          # the checker scans. Missing file is OK (empty allowlist).
+          git show "$BASE_SHA:studio/frontend/.install-script-allowlist" \
+            > /tmp/base-install-script-allowlist 2>/dev/null \
+            || : > /tmp/base-install-script-allowlist
 
       - name: Diff for newly-added install-script deps
         if: github.event_name == 'pull_request'
         run: |
           python3 scripts/check_new_install_scripts.py \
             --base /tmp/base-package-lock.json \
-            --head studio/frontend/package-lock.json
+            --head studio/frontend/package-lock.json \
+            --base-allowlist /tmp/base-install-script-allowlist
 
       - name: Skip install-script diff (non-PR trigger)
         if: github.event_name != 'pull_request'