[siracusa5]

Summary

Consolidates all six open Dependabot PRs and refreshes the three app dependency trees to resolve the current security findings. Fresh full-tree npm audits report zero vulnerabilities for console, site, and desktop; the separate desktop production audit is also clean.

Supersedes #193, #195, #198, #202, #203, and #204, which are closed in favor of this combined PR.

Changes

• Update React, Vite, Vitest, jsdom, Astro, Starlight, Sharp, the pinned Supabase client, Electron, and CodeQL; resolve compatible transitive security patches without forced overrides.
• Cover 17 of the 18 initially open Dependabot alerts (feat(site): make install page Mac-first #61–docs: define Project Profiles delivery plan #69 and chore: require DCO sign-off on contributions #71–chore(deps-dev): bump the console-dependencies group in /apps/console with 4 updates #78). Alert feat(core): add Manifest v2 trust boundary #70 is the upstream-withdrawn sprintf-js advisory GHSA-hp3w-g68c-fv3c, withdrawn October 22, 2026; it has been dismissed as inaccurate with the upstream evidence recorded.
• Require Node ^22.23.4 in CI and both site deployment paths so the Astro update cannot pick an unsupported cached Node 22 patch.
• Warm Electron through its public package entry point before parallel desktop tests. Electron 44's first-use download otherwise races while extracting the binary on a fresh install.
• Fix the pre-existing stale-lock owner-generation race exposed by Node 24 CI: verify parked owner identity and staleness, retain the old inode until replacement placement, and keep cleanup errors from stranding a live lock. Two deterministic regressions cover replacement identity and cleanup failure.
• Record the alert mapping, resolved versions, and verification in the dated security audit.

Affected area

• Core engine / MCP / write path
• Console
• Site
• Playground or local demo surfaces
• Docs / specs / contributor workflow
• Packs

Desktop runtime and build tooling are also updated.

Validation

All local checks used Node 22.23.4.

• npm test: 76/76 root suites, including retrieval eval, package/release checks, and scale/lifecycle tests.
• npm --prefix apps/console run typecheck
• npm --prefix apps/console test: 789 tests.
• npm --prefix apps/console run build:live: production renderer build.
• npm --prefix apps/site run build: 41 pages; install-page and hidden-commerce verification.
• Fresh desktop npm ci && npm test: 186 tests, including settings, quit persistence, and window lifecycle.
• Desktop navigation and CLI-status checks.
• Sandboxed Electron boot/token smoke with temporary app data: authenticated 200, unauthenticated 401.
• Desktop 3,000-document isolation check: 6 ms main-loop lag (400 ms limit).
• Fresh full-tree npm audits for all three apps and separate desktop --omit=dev audit: zero findings.
• Independent code, security, and documentation review: no outstanding blockers.
• Release-workflow and distribution-artifact checks after the Node setup correction: 31 tests.
• Manifest-lock tests: 22 pass; the live-replacement regression failed against the original code.
• GitHub CI checks pass on ed5cae3: required gate, full engine suites on Node 22/24, Windows engine, console, site, Mac/Linux desktop, CodeQL, and DCO.

Compatibility

• Root commands still work. App toolchains now require Node 22.23.4 or a compatible newer runtime; the dependency-free engine floor remains Node 22.
• No root npm dependencies were added.
• Generated files remain ignored.
• Desktop package and lockfile root versions remain 0.10.0.

Electron moves to 44.9.3 and Vitest to 5.0.5, covering the pending major updates with their latest compatible patches. No release or deployment is performed here; packaged-app fixes reach users through the next signed app release. Patched GitHub alerts close after merge and dependency-graph refresh.

The existing lock protocol also has a separate three-contender parking/restoration risk documented in the audit note. This PR makes the measured owner-generation correction; it does not claim to redesign the complete acquisition/reclamation protocol.

Sign-off

• Every commit is signed off per the Developer Certificate of Origin.