Update official JavaScript actions and QEMU to their latest checked releases, and let Dependabot propose weekly Actions updates against dev. Adapt npm publishing authentication to setup-node v7 without exposing a token during dependency installation.
Add a daily default-branch maintenance check with read-only audit permissions. It identifies the npm release supplied by the exact Node pin, audits that CLI and its bundled dependencies using an isolated script-disabled lockfile, and retains the JSON report. Available npm updates and advisory entries emit warnings only: no independent npm replacement, auto-fix, automatic merge or release.
A separate write-scoped job can propose same-major Node LTS updates as regular, non-draft PRs. Revalidate the pin, preserve existing or closed proposals, never overwrite a branch, and document the maintainer action needed to trigger validation for GITHUB_TOKEN-created PRs. Installed applications and current runtime pins remain unchanged.
Validation: 21 offline maintenance, packaging and artifact-helper tests; root typecheck; real npm audit and metadata lookup; YAML and actionlint checks (apart from the existing disabled ARM64 job warning).
2e3d4adf8f