Distillation

["901ed47911c954919232329b6b141637","00aef51a5eb96fc436a544fd2b686d48","90b54a43980a3558c7a35fea68ca168b","5ab1d79bfd80d6f97d19b48aea56eb24"]

<observations> Date: July 28, 2026 * 🔴 (11:28) User ran `git add` resulting in staged changes: package.json (18 +/-), packages/spotlight/package.json (4 +/-), pnpm-lock.yaml (999 lines, 318 insertions/703 deletions). User implicitly confirmed summary of fixes. * 🟡 (11:28) Assistant delivered final summary of 22/24 Dependabot alerts fixed: 2 direct dep bumps (@hono/node-server ^1.19.14→^2.0.5, react-router-dom ^7.17.0→^7.18.0) + 10+ pnpm overrides in root package.json. Verification: website build ✓, Spotlight build ✓, 215 unit tests ✓. * 🟡 (11:28) Assistant documentation of remaining: #301/#302 (astro, deferred), #322 (react-router RSC CSRF, no react-router-dom@8.x published), 2 pre-existing biome lint errors in sentry-config.ts / server/cli/server.ts. * 🔴 (11:42) User approved tackling the Astro 6→7 / Vite 8 migration NOW (instead of deferring to separate PR). Scope: resolve Dependabot alerts #301 (astro ≥3.10.0