Dependency-update PR workflow

Chose the regular PR workflow over direct updates or silently replacing Dependabot PRs because dependency changes need auditable, minimal diffs.

Steps:

1. Inspect package.json and lockfile diffs — confirm peer ranges and reject unrelated churn.
2. Create a properly named branch and commit intended changes, including .lore.md — flag unintended generated changes.
3. Verify remote tracking, push the correct branch, and open the PR immediately.
4. Require green CI, rerun flaky jobs, and apply the immutable merge gate [[01a08a72-1dec-7485-b840-461bef48aac8]].
5. Close replaced or duplicate PRs, then merge only when clean.

Gotchas:

• Fork-only artifacts look sufficient but can be inaccessible; keep review artifacts base-repository fetchable [[01a08a6f-926b-7b29-ac24-6db25845894d]].

Verify:

• [ ] Peer dependencies resolve.
• [ ] No duplicate PR remains open.