ci: add a verify workflow and Renovate config (first .github/ in repo history)

`pnpm run verify` was the whole quality gate and it only ran when a human
remembered to, or at deploy time - which can be days after the merge that
broke it. `git log --all -- .github` was empty. Closes the structural half of
issue #54.

The workflow runs `pnpm run verify` verbatim rather than re-listing its three
phases, so CI and local cannot drift into two definitions of "consistent".
No refs:sync (needs a Factorio binary), no build step, no deploy, no secrets.

Third-party actions are pinned to full commit SHAs with the release named in a
trailing comment; permissions are `contents: read` only.

Renovate over Dependabot because the holds here need encoding, not ignoring:
typescript is disabled outright, pako carries a 14-day age and a note pointing
at the byte-exactness invariant, wrangler + vitest-pool-workers are grouped
because pool-workers hard-pins wrangler, and the brace-expansion override and
`engines.node` floor are both marked not-a-stale-version. `minimumReleaseAge`
is declared at 3 days specifically so Renovate can never propose a release
fresh enough to make pnpm write a `minimumReleaseAgeExclude:` bypass.

Config validated with `renovate-config-validator`. Renovate stays inert until
the GitHub App is enabled on the repo.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F3a2HLJ4beKARi7SPmaM54

Author: wormeyman

.github/renovate.json5

@@ -0,0 +1,122 @@
+// Dependency automation for this repo (issue #54). Renovate, not Dependabot:
+// several of this project's dependency decisions are deliberate HOLDS whose
+// reasoning lives in CLAUDE.md prose, and Dependabot's `ignore` entries cannot
+// express most of them. Everything below exists to stop a bot from cheerfully
+// re-proposing, every week, the exact bump this project has already decided
+// against - and to make the reason travel with the proposal when there is one.
+//
+// This file does nothing on its own. Renovate only acts once the Renovate
+// GitHub App is enabled for the repository (https://github.com/apps/renovate).
+// Validated with `renovate-config-validator` before landing.
+//
+// THE pnpm INTERACTION, which is the subtle part.
+// This workspace relies on pnpm 11's built-in release-age cooldown - there is no
+// `minimumReleaseAge` line in pnpm-workspace.yaml, the guard is a pnpm default.
+// When pnpm is asked to install something newer than that cooldown allows it
+// does not fail; it writes a `minimumReleaseAgeExclude:` bypass into
+// pnpm-workspace.yaml, which is how `vue-tsc@3.3.8` once silently waived the
+// guard. A dependency bot is a machine for producing exactly that situation.
+// So `minimumReleaseAge` is declared HERE, explicitly, at a value comfortably
+// above pnpm's default: Renovate must never open a PR for a release pnpm would
+// want a bypass for. Declaring it also means a future pnpm changing its default
+// cannot move this repo's floor silently.
+// If `minimumReleaseAgeExclude:` ever appears in a Renovate PR's diff, that PR
+// is wrong - do not merge it, fix the age rule instead.
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: [
+    "config:recommended",
+    // Pin every GitHub Action to a commit SHA rather than a moving tag, and keep
+    // the `# vX.Y.Z` comment beside it updated. .github/workflows/verify.yml is
+    // already written that way by hand; this makes it the rule for anything
+    // added later, so the choice cannot drift action-by-action.
+    "helpers:pinGitHubActionDigests",
+  ],
+
+  // See the pnpm interaction above. This is a floor, not a preference.
+  minimumReleaseAge: "3 days",
+
+  // The central invariant here is byte-exactness against captured fixtures, and
+  // a green CI run is evidence of consistency, not of a bump being *correct*
+  // (`pnpm run verify` does not exercise every dependency - see the js-beautify
+  // note in pnpm-workspace.yaml). Nothing merges unread.
+  automerge: false,
+
+  dependencyDashboard: true,
+
+  // One weekly batch instead of a trickle. Times are UTC (no `timezone` set).
+  schedule: ["before 6am on monday"],
+
+  packageRules: [
+    {
+      // THE ONE THAT MATTERS MOST. Without it a bot proposes 6.0.3 -> 7.x every
+      // single week and someone re-derives the refusal every time (see #48, #52).
+      // TypeScript 7 exposes no programmatic API yet, the official migration is
+      // a dual-install alias, and vue-tsc/Volar cannot type-check .vue against
+      // it. Revisit at 7.1 deliberately, by hand.
+      matchPackageNames: ["typescript"],
+      enabled: false,
+    },
+    {
+      // The codec's byte-exactness rests on `{ level: 9, legacyHash: true }`.
+      // `legacyHash` is a pako EXTENSION with no zlib-API contract, from a
+      // library that already flipped that default inside a single major (2.2.0
+      // added it defaulting true, 3.0.0 flipped it false). A pako bump is a
+      // codec change until proven otherwise.
+      matchPackageNames: ["pako"],
+      minimumReleaseAge: "14 days",
+      automerge: false,
+      prBodyNotes: [
+        "**Read `src/codec/deflate.ts` and the pako table in CLAUDE.md before merging.** Deflate must stay madler-zlib-compatible at level 9 and byte-exact against all 9 fixtures. `test/deflate.spec.ts` has a block that fails by name if `legacyHash` is dropped, renamed or re-defaulted - do not silence it by editing a fixture.",
+      ],
+    },
+    {
+      // @cloudflare/vitest-pool-workers hard-pins an exact wrangler. Split PRs
+      // cannot resolve, so these two only ever move together.
+      matchPackageNames: ["wrangler", "@cloudflare/vitest-pool-workers"],
+      groupName: "cloudflare worker toolchain",
+      prBodyNotes: [
+        "After merging, regenerate the worker types: `pnpm --filter @fmw/preview-worker exec wrangler types && pnpm vp check --fix`. The formatter pass is not optional.",
+      ],
+    },
+    {
+      // `overrides.brace-expansion: 2.1.3` in pnpm-workspace.yaml is a
+      // deliberate maintenance-backport pin, not a stale version. Renovate would
+      // read it as three majors behind and propose 5.x, which is a spike into a
+      // dual-ESM/CJS package consumed by a CJS minimatch - explicitly rejected.
+      // The advisory's flat `<=5.0.7` range also means `pnpm audit` still flags
+      // 2.1.3 even though it carries the fix, so "the audit is red" is not a
+      // reason to take this bump. Read the comment in pnpm-workspace.yaml first.
+      matchPackageNames: ["brace-expansion"],
+      matchDepTypes: ["overrides", "pnpm.overrides"],
+      enabled: false,
+    },
+    {
+      // `engines.node` is a deliberately permissive FLOOR (">=24.18.0"): older
+      // versions are untested, not known-broken. It is not a version to keep
+      // current. The version CI and development actually run on is
+      // `.node-version`, which Renovate may bump (see below).
+      matchDepTypes: ["engines"],
+      enabled: false,
+    },
+    {
+      // `.node-version` became machinery, not documentation, the moment
+      // .github/workflows/verify.yml started feeding it to setup-node. Bumps are
+      // welcome but never unattended.
+      matchFileNames: [".node-version"],
+      prBodyNotes: [
+        "This changes the Node version **CI** runs on, not just a local hint. Run `pnpm run verify` locally on the proposed version before merging.",
+      ],
+    },
+    {
+      // vite-plus is pre-1.0 and is the entire static-check + test toolchain.
+      // Its tsgolint engine bumps have twice re-triggered the `TS2321: Excessive
+      // stack depth ... UserConfig` pathology in vite.config.ts, which looks
+      // like a type error in this repo and is not one.
+      matchPackageNames: ["vite-plus"],
+      prBodyNotes: [
+        "If `vp check` starts reporting `TS2321: Excessive stack depth comparing types ... 'UserConfig'`, that is the known vite.config.ts comparison-depth pathology, not a real type error - see the type-checking section of CLAUDE.md for the `vue() as Plugin` cast that collapses it.",
+      ],
+    },
+  ],
+}

.github/workflows/verify.yml

@@ -0,0 +1,77 @@
+# The whole quality gate, run automatically. Until this file existed, `pnpm run
+# verify` only ran when a human remembered to (or at deploy time, which can be
+# days after the breaking merge) - see issue #54.
+#
+# This job deliberately runs `pnpm run verify` VERBATIM rather than re-listing
+# its three phases as separate steps. `verify` is the single definition of "the
+# repo is consistent"; splitting it here would create a second definition that
+# can silently drift from package.json. Note it is `verify`, not `check` -
+# `check` is `vp check --fix` and CI must never rewrite files.
+#
+# What is deliberately NOT here:
+#   - `pnpm refs:sync`. It needs a Factorio binary and ~/GitHub/factorio-data,
+#     neither of which exists on a runner. `verify` is designed to pass with no
+#     Factorio installed and that property is what makes this workflow possible.
+#   - `pnpm vp build`. Not part of `verify`, and the build stamp reads git
+#     history, so it wants a checkout policy of its own. Tracked as a follow-up.
+#   - Any deploy step or credential. Cloudflare Pages does not build this repo
+#     (`deploy:app` uploads an already-built `dist`), so CI here is a check
+#     only and the job needs no secrets at all.
+name: verify
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # So a run can be forced without an empty commit.
+  workflow_dispatch:
+
+# Superseded pushes to the same PR are pointless at ~2 minutes a run.
+concurrency:
+  group: verify-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Minimum scope: the job only reads the tree. It writes no statuses, comments,
+# packages or releases, so nothing beyond `contents: read` is granted.
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    # `verify` is ~60-90s of work; 15 minutes is a hang detector, not a budget.
+    timeout-minutes: 15
+    env:
+      # `preview:test` shells out to wrangler (`wrangler types --check`). Keep it
+      # from phoning home for telemetry on a runner where nobody can answer the
+      # opt-in prompt.
+      WRANGLER_SEND_METRICS: "false"
+    steps:
+      # Third-party actions are pinned to a full commit SHA, never a moving tag.
+      # The trailing comment names the release each SHA is, and Renovate updates
+      # the SHA and that comment together - see .github/renovate.json5.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # No `version:` input on purpose. pnpm/action-setup >= 6 reads
+      # `devEngines.packageManager` from package.json, so the pnpm pin stays in
+      # exactly one place. Hard-coding it here would be a second pin to drift.
+      # This step must precede setup-node: `cache: pnpm` below resolves the
+      # store path by running pnpm, so pnpm has to be on PATH already.
+      - uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
+
+      # `.node-version` (26.5.0) is the single source of truth for the Node
+      # version, and this is its first real consumer - the file went from
+      # documentation to machinery when this workflow landed. `engines.node`
+      # stays a permissive floor and is deliberately NOT what CI runs.
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .node-version
+          cache: pnpm
+
+      # A full workspace install. Anything narrower can leave a sibling
+      # workspace's symlink dangling and produce fake
+      # `TS2307: Cannot find module 'vitest'` errors; a real full install is the
+      # one that reports `Scope: all 3 workspace projects`.
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm run verify