Require full verification, resolved reviews, and explicit authorization before merging

Before marking work done or merging, run tsc, lint, Prettier, full tests, and relevant docs build/preview. Perform an adversarial no-rubber-stamp review; resolve and reply to every human and bot thread; and verify the exact remote PR head: bots clean, CI green, mergeable state not BLOCKED, and only intended files committed (excluding lore/agent churn and untracked or stash leftovers). Ensure fixes are committed and pushed before final CI/review. Wait for explicit user authorization; then use GitHub API admin squash-merge, never gh pr merge. After merge, confirm Dependabot alerts close and investigate new alerts in a follow-up PR.