ci: pin coverage Python/gcovr and align lockfile docs

[enochgroot]

Follow-up nits from the 3.4.0 re-review (c0f78a1..4f93644). Does not change package version, engines, CI matrix, native code, or the 95% coverage gate.

Changes

• Pin coverage job to Python 3.12 and gcovr==8.6 (drop floating 3.x / unpinned --upgrade).
• Record package 3.4.0 in package-lock.json top-level and packages[""].version to match package.json.
• Name package.json + package-lock.json in SECURITY.md inventory (there is no shrinkwrap in tree).

Action uses: SHA pins, Node 22-only matrix, and npm ci then npm run coverage are unchanged.

Please squash-merge; do not npm publish from this PR.

[enochgroot]

Review (ranked)

merge: nit-only on 71f3b55ffd8f44fff6c7d846328a7f62a1d7a18a.

Catalog leaves on this three-file nit: github-workflow (no issues), owasp-supply-chain-failures (no issues), owasp-a08-software-integrity-failures (one residual nit). Matcher hits web-path-traversal and mcp-sandbox-escape were dropped as false positives.

1. OPEN Nit (4) CWE-494 — .github/workflows/ci.yml:40 — pip install gcovr==8.6 authenticates TLS to PyPI, not the wheel. No --require-hashes. Job is coverage-only (npm ci + npm run coverage); no publish/deploy secrets. This diff already replaced unpinned pip install --upgrade gcovr with the requested exact pin. Optional follow-up: hashed requirements file. Not merge-blocking.

Independent coverage job 106836618897: CPython 3.12.14, gcovr-8.6, JS All files 100 / 98.71 / 100 / 100, native lines 95.7% (1144/1196) / functions 100% / branches 96.1% (1051/1094), fail 0. Node matrix remains [22]. JS and native gates remain 95. nan stays exact 2.28.0; c8 stays exact 12.0.0. PyPI gcovr 8.6 is not yanked and is current latest.

Report: REVIEW-msgpack-node-fix-review-nits-master.md