build(ci): only audit for production dependencies