chore: retire the legacy CI review pipeline

.githooks/pre-commit

@@ -3,10 +3,12 @@
 set -euo pipefail
 
 ignored_staged_paths=(
-  ":(exclude).agents/**"
   ":(exclude).claude/**"
   ":(exclude).clawpatch/**"
   ":(exclude).codex/**"
+  ":(exclude).agents/rules/**"
+  ":(exclude).agents/*.md"
+  ":(exclude).agents/**/*.md"
 )
 
 git diff --cached --check -- . "${ignored_staged_paths[@]}"
@@ -70,10 +72,9 @@ run_script() {
 
 if [[ -f pnpm-lock.yaml ]] && command -v pnpm >/dev/null 2>&1; then
   if has_staged_changes package.json pnpm-lock.yaml pnpm-workspace.yaml; then
-    # Order matters: dedupe is the cheaper read-only check, so fail fast on
-    # lockfile bloat before the heavier lockfile-vs-package.json sync check.
+    # Materialize first: dedupe --check can purge a topology-mismatched node_modules before its check-only phase.
+    pnpm install --frozen-lockfile --ignore-scripts --config.confirm-modules-purge=false --config.optimistic-repeat-install=false
     pnpm dedupe --check --config.confirm-modules-purge=false
-    pnpm install --frozen-lockfile --ignore-scripts --config.confirm-modules-purge=false
   fi
 fi
 

.github/workflows/checks.yml

@@ -7,10 +7,23 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+# pnpm 11 defaults verify-deps-before-run to "install": the first `pnpm
+# <script>` or `pnpm exec` whose deps-status check sees drift re-runs a full
+# install with lifecycle scripts enabled, silently dropping this workflow's
+# install flags — a prepare hook the hardened --ignore-scripts install skipped
+# then runs in CI. Only this spelling disables it: pnpm reads
+# pnpm_config_verify_deps_before_run raw from the environment, and the
+# npm_config_ spelling is silently ignored.
+env:
+  pnpm_config_verify_deps_before_run: "false"
+
 jobs:
   quality-checks:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    strategy:
+      matrix:
+        node: ["24.15.0", "26.5.0"]
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -25,7 +38,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version-file: "package.json"
+          node-version: ${{ matrix.node }}
           cache: "pnpm"
 
       - name: Verify install secret

.github/workflows/commit-msg.yml

@@ -16,6 +16,16 @@ jobs:
     timeout-minutes: 5
     env:
       COMMITLINT_PACKAGE_VERSION: "1.0.3"
+      # npm's fetch-timeout defaults to 300s — exactly this job's cap — so one
+      # stalled request eats the whole budget in silence and the job is killed
+      # before npm's own retry ever fires. Observed as five consecutive 5m00s
+      # timeouts across align and cluster while the same install took 6s when
+      # it worked. Bounding the request keeps the retries useful and turns the
+      # tail from minutes into seconds; the cap below then means what it says.
+      npm_config_fetch_timeout: "30000"
+      npm_config_fetch_retries: "3"
+      npm_config_fetch_retry_mintimeout: "1000"
+      npm_config_fetch_retry_maxtimeout: "10000"
     steps:
       - uses: actions/checkout@v6
         with:
@@ -24,7 +34,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: "24"
+          # Deliberately policy-pinned: this workflow runs only a version-pinned npm package and takes no toolchain input from the PR tree — the template, not node-version-file, supplies the fleet baseline.
+          node-version: "26.5.0"
 
       - name: Cache conventional-commit-msg download
         uses: actions/cache@v5

.github/workflows/dedupe-check.yml

@@ -11,6 +11,16 @@ on:
     paths:
       - pnpm-lock.yaml
 
+# pnpm 11 defaults verify-deps-before-run to "install": the first `pnpm
+# <script>` or `pnpm exec` whose deps-status check sees drift re-runs a full
+# install with lifecycle scripts enabled, silently dropping this workflow's
+# install flags — a prepare hook the hardened --ignore-scripts install skipped
+# then runs in CI. Only this spelling disables it: pnpm reads
+# pnpm_config_verify_deps_before_run raw from the environment, and the
+# npm_config_ spelling is silently ignored.
+env:
+  pnpm_config_verify_deps_before_run: "false"
+
 jobs:
   dedupe-check:
     runs-on: ubuntu-latest
@@ -29,7 +39,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version-file: "package.json"
+          node-version-file: ".node-version"
           cache: "pnpm"
 
       - name: Verify install secret

.github/workflows/release-npm.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version-file: "package.json"
+          node-version-file: ".node-version"
           cache: "pnpm"
 
       - name: Verify install secret

.node-version

@@ -0,0 +1 @@
+26.5.0

.oxfmtrc.json

@@ -10,6 +10,8 @@
     ".claude/",
     ".clawpatch/",
     ".codex/",
+    "!.agents/skills/**",
+    ".agents/**/*.md",
     "AGENTS.md",
     "CLAUDE.md"
   ]

README.md

@@ -18,7 +18,7 @@ Running `worktree-remove`:
 
 ## Requirements
 
-- Node.js ≥ 24.0.0
+- Node.js ≥ 24.15.0
 - Git with `git worktree` support
 - Optional: set `WORKTREE_REMOVE_GIT_PATH` to override the git executable
 

knip.json

@@ -1,5 +1,6 @@
 {
   "$schema": "https://unpkg.com/knip@6/schema.json",
   "entry": ["src/cli.ts", "types/**/*.d.ts"],
-  "project": ["src/**/*.ts", "types/**/*.d.ts"]
+  "project": ["src/**/*.ts", "types/**/*.d.ts"],
+  "ignoreDependencies": ["conventional-changelog-conventionalcommits"]
 }

package.json

@@ -66,7 +66,7 @@
   "devDependencies": {
     "@j4k/oxlint-config": "^2.11.0",
     "@total-typescript/ts-reset": "^0.6.1",
-    "@types/node": "^25.9.3",
+    "@types/node": "^24.0.0",
     "@vitest/coverage-v8": "^4.1.8",
     "fta-check": "^1.5.4",
     "fta-cli": "^3.0.0",
@@ -79,7 +79,7 @@
     "vitest": "^4.1.8"
   },
   "engines": {
-    "node": ">=24.0.0"
+    "node": ">=24.15.0"
   },
   "packageManager": "pnpm@11.22.0"
 }