Require rigorous, empirically-verified adversarial correctness reviews before merge

When reviewing a PR (dependency bumps, CI changes, build config cleanups), the user consistently demands a skeptical, adversarial CORRECTNESS-only review — explicitly instructing to ignore style/cosmetics. They expect the assistant to: (1) read the actual diff precisely, (2) trace root causes empirically by inspecting real package/lockfile/source code (not just trusting claims), (3) verify version resolution, transitive dependencies, and security advisory status via lockfiles and npm/registry metadata, (4) reproduce or test fixes in a throwaway scratch copy (e.g. /tmp/opencode) — NEVER modifying the real tracked tree — and clean up afterward, (5) check for silent scope creep (diff exactly matches described changes, no untracked side effects), and (6) produce a final explicit verdict (SAFE TO MERGE / not) with severity-ranked findings, including noting low-severity/latent issues even if not blocking. Apply this rigor to any request framed as a correctness/adversarial review.