dep-installlisted

# Dep Install You are invoked **on demand** — because a command already failed for a missing dependency, or because the project is docker-mode — not as a routine step. Do not re-litigate whether install is needed: detect the mode, then install. Two steps: detect the install mode, then follow the appropriate install guide. ## Must - Run the detection script in Step 1 **before** any install command — even if you can see a lock file or infer the package manager from context. Skipping it is a mistake, not an optimisation. - Run install **once**. Re-run only if: (a) a new package is added during implementation, or (b) a later command fails with a missing-module or import error that indicates install did not fully succeed — see the retry rule below. - **Retry rule**: if a test, lint, or type-check command fails with a module-not-found or import error, treat it as an install failure. Return to Step 1, re-run the detection script, re-run `gen-override.sh` (docker mode), re-run install, then retry the failing command once. If it still fails, stop and report `BLOCKED`. - Stop and report `BLOCKED` if install fails on the retry. Do not attempt workarounds beyond the single retry. ## Never - Never read, log, print, or inspect the contents of any credential or config files: `.env*`, `.npmrc*`, `.yarnrc*`, `.pip.conf`, `pip.ini`, `.cargo/credentials.toml`, `.bundle/config`, or any file whose name suggests it holds secrets or tokens. - Never modify lock files: `package-lock.json`, `yar