chore(deps): bump redstamp v0.5.1 -> v0.7.5

[askalf]

Summary

• Pinned at commit 27c2685 (v0.5.1 era) — dozens of releases behind, missing every hardening pass since, most recently a proven bypass of the deterministic black gate via PowerShell's -ArgumentList array form ('-ExecutionPolicy','Bypass',...), which scored green while the equivalent space-separated command correctly scored black (redstamp#124). This repo's whole pitch is "the call proceeds only when all three agree" — redstamp holding a 2-month-old ruleset undercuts that claim directly.
• Same fix propagated today to truecopy, truecopy-action, and platform (forge + mcp-tools), all pinned at the same stale/older redstamp.
• Noted but out of scope here: the sibling @askalf/truecopy (0.8.0) and @askalf/strongroom pins also look old relative to their current releases — worth a follow-up, not bundled into this security fix.

Test plan

• Full suite — 17/17 (includes live "together" tests exercising truecopy+redstamp+strongroom composed)
• npm run demo end-to-end — clean, all four scenarios behave as expected

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer.

Verdict: Clean dependency bump — no blocking issues found.

What I checked

• gh pr diff 40 — the entire change is two files: package.json and package-lock.json, bumping @askalf/redstamp from the 27c2685... commit (v0.5.1) to 5222bc1... (v0.7.5).
• The version/commit pin in package.json:19 and the corresponding node_modules/@askalf/redstamp entry in package-lock.json (version, resolved URL, integrity hash) are all updated consistently and point at the same new commit — no lockfile/manifest drift.
• CI rollup for this head is all green: CodeQL, analyze (javascript-typescript), test, and verify pinned tool surface all pass.
• No other dependencies, source files, or config touched — this PR is scoped exactly to the stated purpose (closing the stale-pin gap described in the PR body, redstamp#124).

What's good

• Minimal, single-purpose diff with a clear rationale in the PR description (specific bypass class being closed) and a stated test plan (17/17 suite, npm run demo clean).
• Lockfile and manifest changes are mutually consistent, which is the main thing that can go wrong in a pin bump like this.

No findings to raise against the changed lines.