Demand evidence-traced, skeptical correctness reviews of dependency changes

When reviewing dependency-bump PRs (Dependabot alerts, version migrations, pnpm overrides), the user requires: (1) read-only investigation with no tracked-file modifications, (2) every claim traced to concrete evidence — lockfile entries, source code, registry metadata, git history — not assumptions, (3) adversarial skepticism of initial hypotheses (e.g., ruling out 'intentional rollback' by checking commit timestamps), (4) explicit CRITICAL findings flagged with merge consequences (e.g., rebase artifacts causing version regression), and (5) one focused change per PR (security fixes separate from framework migrations). Experiment in /tmp rather than mutating repo state. Report findings as structured numbered lists.