review-ci

# Review CI Run a **CI-focused** review: GitHub Actions workflow, caching, lockfile and reproducibility, branch/trigger strategy, Dependabot, Husky pre-commit, and deploy pipeline. Your reply must be a **plan of suggested changes**: concise, actionable, and structured-not only prose. ## Invocation Text after the slash command is additional scope/focus - narrow the review accordingly. If none given, use the default scope described below. ## Best practices alignment - **Workflow** - Checkout with sufficient fetch depth when needed; Node and pnpm versions pinned and aligned with package.json engines/packageManager; steps run in a sensible order (install → lint → typecheck → build). - **Caching** - pnpm store and optionally Turborepo remote cache to speed runs; cache keys include lockfile hash where appropriate. - **Reproducibility** - CI install uses `--frozen-lockfile` (or equivalent) so builds fail on lockfile drift; same Node/pnpm versions as local dev. - **Permissions** - Minimal permissions (e.g. contents: read for CI that only needs to read repo); no write unless deploy or release. - **Secrets** - No secrets in logs; use GitHub secrets for any tokens; mask in outputs if needed. - **Hooks** - Pre-commit runs formatter/lint on staged files; fast and deterministic (e.g. oxfmt format only or check). - **Deploy** - Deploy step separate from main CI or behind approval; optional smoke/health check after deploy. Align with root [AGENTS.md](../../../AGENTS.md) for Makefile t...