Add attack surface audit artifacts

- Add advisory, entrypoint, and candidate scan outputs
- Capture dependency intelligence and cross-service attack surface notes

piolium/attack-surface/lite-recon.md

@@ -0,0 +1,64 @@
+# Lite Recon — Q0
+
+Generated by piolium at 2026-05-27T05:18:10.214Z
+
+## Target
+
+- Path: `/Users/kell/dev/islandflow`
+- Repository: (unknown)
+- Total files (scanned): 291
+- Total bytes (scanned): 3.5 MB
+
+## Git
+
+- Commit: ffbdbc337638004be49775c85a2f0b10b7e55563
+- Branch: security-audit
+- History available: true
+
+Recent commits:
+
+```
+ffbdbc3 docs: add May 24 standup git summary
+3300728 set up forgejo ci baseline
+3c444b7 Merge pull request 'rename tape to options and replace web rail with overlay drawer' (#11) from sidebar-redesign into main
+7ca0e05 rename tape to options and switch the web shell to a drawer
+f056f6d clarify when turn docs are actually required
+fda7d5f add turn doc for pierre diffs policy update
+4a0e9e7 default turn-doc diffs to @pierre/diffs and add dependency
+5ff2fa6 turn doc instruction tuning
+2e48283 sync github mirror for docs pages workflow fix
+aae3fa1 fix docs pages workflow for gh-pages branch deploy
+```
+
+## Languages
+
+- TypeScript: 134 file(s)
+- Shell: 11 file(s)
+- Python: 2 file(s)
+
+## Build / Project Manifests
+
+- `apps/desktop/package.json`
+- `apps/web/package.json`
+- `deployment/docker/Dockerfile.ingest-options`
+- `deployment/docker/Dockerfile.service`
+- `deployment/docker/Dockerfile.web`
+- `deployment/docker/docker-compose.yml`
+- `deployment/docker/workspace-root/package.json`
+- `docker-compose.yml`
+- `package.json`
+- `packages/bus/package.json`
+- `packages/config/package.json`
+- `packages/observability/package.json`
+- `packages/storage/package.json`
+- `packages/types/package.json`
+- `services/api/package.json`
+- `services/candles/package.json`
+- `services/compute/package.json`
+- `services/eod-enricher/package.json`
+- `services/ingest-equities/package.json`
+- `services/ingest-news/package.json`
+- `services/ingest-options/package.json`
+- `services/ingest-options/py/requirements.txt`
+- `services/refdata/package.json`
+- `services/replay/package.json`