Salvage the report's only actionable content — automate Dart osv-scanner
and native SHA256 verification in CI — into T-299, then drop the stray
root-level analysis doc (the rest was praise + an exploration trace;
recoverable from history at bf4b6be).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>