Require rigorous adversarial correctness review before merging build/dependency PRs

When working on Electron build/dependency PRs (electron-builder upgrades, notarization/signing changes, dependency override fixes), the user always requires an independent, adversarial correctness verification pass before merging — not just relying on CI green checks. This includes: (1) tracing the actual dependency resolution in the lockfile to confirm which transitive versions are used at runtime, (2) reading the relevant node_modules source to verify code paths (e.g., signing/notarize logic) rather than assuming behavior, (3) cross-checking env var names between CI workflow jobs and consumed scripts/libraries, (4) explicitly noting CI gaps (e.g., macOS build job only runs on push to main, not PRs) as residual risk, and (5) independently reproducing build failures/fixes locally (e.g., pnpm build:mac) rather than trusting a plain pnpm build. The assistant should proactively perform this deep verification, produce a todo list covering these checks, and give an explicit SAFE-TO-MERGE/NOT-SAFE verdict with cited evidence before recommending merge.