Always conduct rigorous lockfile forensics and adversarial correctness reviews of dependency/build changes

The user consistently expects exhaustive, evidence-based verification of dependency bumps and build-config PRs. Trace full transitive dependency chains in the lockfile to catch phantom/stale resolutions and peer-dep mismatches; read upstream package source to confirm actual runtime behavior. When asked to review, perform an adversarial correctness review focused strictly on real bugs and regression risks (especially electron-builder/notarization/signing and vulnerable transitive deps) — explicitly ignore style and cosmetic changes. Follow the security dep-bump workflow: fetch alerts, plan, bump pnpm overrides + direct deps, install/build/test, branch, commit with .lore.md staged and untracked dirs excluded, open PR.