OSV ignore ledger: image-size (no fixed release) via html-to-docx — re-justify by 2026-11-30

The v1.78.0.0 wave's OSV pass suppresses two image-size advisories (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr, both 8.7) with `ignoreUntil = 2026-11-30` in `.osv-scanner.toml` because NO fixed release exists (FIXED VERSION = `--` on both) and the only consumer is html-to-docx@1.8.0 (pins ^1.0.0).

Exposure assessment from the wave: image-size only parses images the user embeds into their own generated .docx — no untrusted-input path.

Upgrade triggers (whichever comes first):
- image-size publishes a fixed release → bump via overrides, drop both ignores.
- html-to-docx moves off image-size → lockfile refresh, drop both ignores.
- The ignoreUntil expiry (2026-11-30) fires → the weekly OSV lane goes red and this decision must be re-justified or re-dated here.

The wiring test (test/osv-config-wiring.test.ts) enforces that every ignore carries an expiry, so this cannot silently become permanent.

Read the two image-size entries in .osv-scanner.toml and the wiring test at test/osv-config-wiring.test.ts. Check that both advisories retain an expiry and that the documented upgrade triggers still apply. Done means the OSV configuration and its wiring test consistently enforce the time-bounded decision.

Written by the indexing model from the issue text.