ci: reuse quality gate across CI and release workflows (#167)

docs/RELEASING.md

@@ -85,6 +85,7 @@ Notes:
 - Prerelease tags intentionally keep `changes/*.md` fragments in place so multiple prereleases can reuse the same cumulative pending notes until the final stable cut. `make clean` preserves `release/prerelease-notes.md` while deleting generated build artifacts.
 - If you need to repair a published release body (for example, a prior version’s section was omitted), regenerate notes from `CHANGELOG.md` and re-edit the release with `gh release edit --notes-file`.
 - Prerelease tags are handled by `.github/workflows/prerelease.yml`, which always publishes a GitHub prerelease with all current release platforms and never runs the AUR sync job.
+- CI, stable release, and prerelease workflows call the shared `.github/workflows/quality-gate.yml`; update that reusable workflow when changing common test coverage. Its environment suite includes the Lua mpv plugin tests.
 - Tagged release workflow now also attempts to update `subminer-bin` on the AUR after GitHub Release publication.
 - Stable release tags update `https://docs.subminer.moe/` and `https://docs.subminer.moe/v/<version>/` through `.github/workflows/docs-pages.yml`; `/main/` continues to show development docs from `main`.
 - Keep Cloudflare Pages Git auto-deploy disabled for `docs.subminer.moe`. Production docs are direct-uploaded by Wrangler from GitHub Actions with `--branch main`.

docs/workflow/verification.md

@@ -18,6 +18,11 @@ Read when: selecting the right verification lane for a change
   `--single-process` restores the shared-process mode for debugging.
 - `bun run test:fast` is the full source gate: discovered `src/**`, launcher
   unit, `scripts/**`, and the compiled runtime-compat slice.
+- `.github/workflows/quality-gate.yml` is the reusable `workflow_call` gate for
+  pull requests, stable tags, and prerelease tags. Keep common quality steps
+  there instead of copying them into caller workflows.
+- The reusable gate installs Lua and runs `bun run test:env`, so the shipped mpv
+  plugin tests run for every pull request and tagged release.
 
 ## Default Handoff Gate
 
@@ -52,7 +57,14 @@ bun run docs:build
 
 - `bun run test:coverage:src` runs the maintained `test:src` lane through a sharded coverage runner: one Bun coverage process per test file, then merged LCOV output.
 - Machine-readable output lands at `coverage/test-src/lcov.info`.
-- CI and release quality-gate runs upload that LCOV file as the `coverage-test-src` artifact.
+- Every reusable quality-gate run uploads that LCOV file as the
+  `coverage-test-src` artifact.
+
+## Dependency Audit Policy
+
+- `bun audit --audit-level high` blocks the reusable quality gate.
+- Keep security overrides and dependency patches at the minimum fixed version.
+  Remove them after the owning package ships and adopts a compatible fix.
 
 ## Rules