ci: reuse quality gate across CI and release workflows (#167)

docs/workflow/verification.md

@@ -18,6 +18,11 @@ Read when: selecting the right verification lane for a change
   `--single-process` restores the shared-process mode for debugging.
 - `bun run test:fast` is the full source gate: discovered `src/**`, launcher
   unit, `scripts/**`, and the compiled runtime-compat slice.
+- `.github/workflows/quality-gate.yml` is the reusable `workflow_call` gate for
+  pull requests, stable tags, and prerelease tags. Keep common quality steps
+  there instead of copying them into caller workflows.
+- The reusable gate installs Lua and runs `bun run test:env`, so the shipped mpv
+  plugin tests run for every pull request and tagged release.
 
 ## Default Handoff Gate
 
@@ -52,7 +57,14 @@ bun run docs:build
 
 - `bun run test:coverage:src` runs the maintained `test:src` lane through a sharded coverage runner: one Bun coverage process per test file, then merged LCOV output.
 - Machine-readable output lands at `coverage/test-src/lcov.info`.
-- CI and release quality-gate runs upload that LCOV file as the `coverage-test-src` artifact.
+- Every reusable quality-gate run uploads that LCOV file as the
+  `coverage-test-src` artifact.
+
+## Dependency Audit Policy
+
+- `bun audit --audit-level high` blocks the reusable quality gate.
+- Keep security overrides and dependency patches at the minimum fixed version.
+  Remove them after the owning package ships and adopts a compatible fix.
 
 ## Rules