In short
GitHub code scanning's code-quality findings are fixed: a
promise formatted as text, undeclared globals, an upload that hung on an
unreadable file, and the lint around them. npm run lint:promises
now finds promises that are not awaited or handled.
Thanks to above GitHub users for their contributions.