Require deep evidence-based verification before trusting build/CI config changes

When reviewing or making changes to sensitive build/CI infrastructure (especially macOS signing/notarization in electron-builder), the user expects rigorous, adversarial verification rather than surface-level trust. This means: reading actual source code in node_modules to confirm library behavior, cross-referencing CI logs line-by-line, checking pnpm-lock.yaml resolution chains for transitive dependency changes, distinguishing coincidental log line matches from causal proof, and explicitly flagging residual/unverifiable risk (e.g., 'can only be confirmed post-merge'). The user pushes back on assumptions (e.g., re-checking whether double-notarization claims are actually proven) and wants explicit severity/risk verdicts per concern rather than a blanket approval. When told to review for 'correctness only,' ignore style/cosmetic issues and focus solely on functional regression risk, tracing every changed dependency and env var to its actual consumer before declaring something safe.