#2628 feat(build): remove alex dependency, replace with retext-equality and vfile-sort

> [!CAUTION]
> Protected files were modified in this change.
> This pull request is in `request_review` mode and requires explicit human scrutiny before merge.
>
> Protected files: `package-lock.json`, `package.json`, `README.md`

Closes \#2628

## What changed

Removes the `alex@11.0.1` dev dependency and replaces its CLI-inclusive subtree with direct retext composition, eliminating four deprecation warnings (`inflight@1.0.6`, `sliced@1.0.1`, `glob@8.1.0`, `glob@10.5.0`) from the root graph.

### Changes

- **`package.json`** – Removed `alex@11.0.1`; added `retext-equality@6.6.0` and `vfile-sort@4.0.0` as exact dev dependencies.
- **`package-lock.json`** – Regenerated via `npm install` + `npm ci`; public registry URLs with `sha512` integrity values; `alex`, `inflight`, `sliced`, `glob@8`, and `glob@10` are absent.
- **`scripts/evals/Modules/retext-runner.mjs`** – Replaced `import { text as alexText } from 'alex'` with `import retextEquality from 'retext-equality'` and `import { compareMessage } from 'vfile-sort'`. The `runAlex()` function is replaced by `runEquality()`, which composes `retext-english → retext-equality → retext-stringify`, sorts messages via `compareMessage`, then applies the existing phrase allowlist. The `source: alex` report contract is preserved.
- **`scripts/evals/Test-EvalSpecText.ps1`** – Updated synopsis and description to reference retext-equality instead of alex.js.
- **`scripts/tests/evals/Test-EvalSpecText.Tests.ps1`** – Updated dependency guard (`$pkgs`) to check for `retext-equality` and `vfile-sort` instead of `alex`. Added two new tests:
- _"Reports equality and profanity messages in stable source order"_ – verifies equality (alex-labeled) messages precede profanity messages in mixed content.
- _"Suppresses an allowlisted phrase while a control phrase still emits a warning"_ – verifies the phrase allowlist suppresses `penetration test` context while still allowing unfamiliar bare uses to flag.
- **`scripts/README.md`** – Updated the `Test-EvalSpecText.ps1` description row.

### Verification

- `npm ls alex inflight sliced` returns empty – deprecated packages are absent.
- Node shim produces `source: alex` for equality findings, `source: retext-profanities` for profanity findings.
- Allowlist correctly suppresses `penetration test` (exit 0) while flagging bare insensitive terms.
- `npm run lint:public-dependency-feeds` passes.
- `npm run validate:local` markdown and table lints pass.

> **Note:** The CI-owned `ci:eval:lint:text` lane is recorded as pending until hosted CI completes.

> [!WARNING]
>
> Firewall blocked 1 domain
>
> The following domain was blocked by the firewall during workflow execution:
>
> - `www.powershellgallery.com`
>> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "www.powershellgallery.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [Issue Implementation Agent](https://github.com/microsoft/hve-core/actions/runs/31273814802) for #2628 · 137.2 AIC · ⌖ 25.5 AIC · ⊞ 7.9K · [◷](https://github.com/search?q=repo%3Amicrosoft%2Fhve-core+%22gh-aw-workflow-id%3A+issue-implement%22&type=pullrequests)

---

> [!NOTE]
> This was originally intended as a pull request, but the git push operation failed.
>
> **Original error:** pushSignedCommits: refusing unsigned push for branch 'feat/remove-alex-dependency-2f28487b299c244b': Signed-commit payload violates file-protection policy (request_review): package-lock.json, package.json, scripts/README.md
>
> **Workflow Run:** [View run details and download bundle artifact](https://github.com/microsoft/hve-core/actions/runs/31273814802)
>
> The bundle file is available in the `agent` artifact in the workflow run linked above.

To create a pull request with the changes:

```sh
# Download the artifact from the workflow run
gh run download 31273814802 -n agent -D /tmp/agent-31273814802

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-31273814802/aw-feat-remove-alex-dependency.bundle refs/heads/feat/remove-alex-dependency:refs/bundles/create-pr-feat-remove-alex-dependency-2f28487b299c244b-573a64d9
git update-ref refs/heads/feat/remove-alex-dependency-2f28487b299c244b refs/bundles/create-pr-feat-remove-alex-dependency-2f28487b299c244b-573a64d9
git checkout feat/remove-alex-dependency-2f28487b299c244b
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-feat-remove-alex-dependency-2f28487b299c244b-573a64d9

# Push the branch to origin
git push origin feat/remove-alex-dependency-2f28487b299c244b

# Create the pull request
gh pr create --title '#2628 feat(build): remove alex dependency, replace with retext-equality and vfile-sort' --base main --head feat/remove-alex-dependency-2f28487b299c244b --repo microsoft/hve-core
```