Deno's audit --fix flag finds 13 vulnerabilities but fixes none

A developer tested deno audit on Deno 2.9.7: it quickly detects npm dependency vulnerabilities, but the --fix, --ignore and --frozen-lockfile flags leave the vulnerable state untouched. In a semver 7.5.1 ReDoS test, deno.lock stayed byte-for-byte identical.

• deno audit found 13 vulnerabilities in minimist, lodash and semver in 0.17–0.30s
• fix did not upgrade semver 7.5.1 to the patched 7.5.2; lockfile unchanged
• ignore failed with both GHSA-c2qf-rxjj-qqgw and CVE-2022-25883
• Lifecycle script blocking works: core-js postinstall ran only after approve-scripts