[jongio]

Summary

Consolidated repo-maintain pass hardening .github/dependabot.yml release-age cooldown and Node 24 runtime parity rules, alongside verified documentation clarifications folded from #25.

Phase Breakdown

Phase	Commit	Summary
1. Governance & Runtime Parity	baaa579	Configure cooldown: { default-days: 7 } on both npm and github-actions ecosystems in .github/dependabot.yml, and ignore @types/node version-update:semver-major updates while the Action targets node24 (engines.node: >=24 <25).
6. Documentation Accuracy	0465ebf	Fold verified documentation clarifications from #25 (with attribution): remove the overbroad README license-capture guarantee in CONTRIBUTING.md (matching tooling/license-notices.mjs's MIT-heading check) and clarify in README.md that copilot-token supports workflow-token authentication in explicit run mode alongside credential-env: COPILOT_GITHUB_TOKEN (matching src/native.ts).

Open PR Disposition

• Supersedes on merge (left open until merge): [Copilot Dreaming] Remove an overbroad license-capture guarantee and clarify token alternatives #25 (both CONTRIBUTING.md and README.md clarifications verified against tooling/license-notices.mjs and src/native.ts and folded with co-author attribution).
• Deferred (< 7-day release cooldown): chore(deps-dev): Bump oxlint from 1.92.0 to 1.93.0 #30 (oxlint 1.92.0 -> 1.93.0 remains held until it clears the 7-day release-age window).

Repo Health Score: 97/100 (A+) -> 97/100 (A+)

Verification

• pnpm check (tsc --noEmit, oxlint --deny-warnings src tests, vitest run --coverage 180/180, node tooling/build.mjs --check, node --test tooling/packaged.test.mjs 6/6)
• pnpm exec vally lint --strict examples/copilot-smoke --eval-spec=examples/copilot-smoke
• pnpm exec vally lint --strict --eval-spec=tests/fixtures

[Copilot]

🟢 Approval recommended

No active review issues are reported, and the documented Dependabot, Node compatibility, authentication, and license-notice updates align with the reviewed changes.

No open issues 🎉

What changed in this PR

This maintenance PR hardens Dependabot release timing and Node 24 compatibility while synchronizing documentation with the implemented authentication and license-notice behavior.

Changes:

• Adds seven-day cooldowns for npm and GitHub Actions Dependabot updates.
• Prevents semver-major @types/node updates while the Action targets Node 24.
• Clarifies workflow-token authentication and narrows the license-notice documentation guarantee.

File	Description
README.md	Clarifies that copilot-token supports workflow-token authentication for explicit runs.
CONTRIBUTING.md	Removes the unsupported broad guarantee about retaining full license sections from package READMEs.
.github/​dependabot.yml	Adds seven-day cooldowns and ignores semver-major @types/node updates.

_{Review effort: Lite (dynamic)}