fix(maintenance): repair CI sampling and dependency updater boundaries

[ty-everett]

Program and scope

Repair three concrete maintenance failures without dropping coverage or dependency ownership. Related: #402. Coordination: #558.

• The CI performance collector formerly stopped at the newest 100 runs and failed before saving evidence when fewer than 20 full-scope samples were present. It now searches bounded history pages, deduplicates heads, paginates all jobs, saves incomplete sample evidence before failing, and rejects incomplete baselines. Sanitized API/collection failures are actionable.
• Standalone npm infrastructure updates were incorrectly treated as pnpm sub-workspace updates because Dependabot fetched ancestor pnpm support files. Exclude only those ancestor files in the standalone npm entry; their root owner and all eight npm manifests/lockfiles remain monitored.
• Dependabot supplies a newer uv than the project's former exact requirement. Permit compatible resolver versions in the project while retaining an explicit uv 0.11.32 CI pin, locked Python dependencies, Python 3.12 and exact generated-output verification.
• Recheck the two expired documentation pages against current source. Correct stale file/line references, BRC-177 abort behavior and Monitor registration counts; label the Go comparison as its historical August review. ChainTracks source verification remains distinct from deployed-image evidence.
• Bound optical-codec fixture search and avoid allocating a Jest matcher for every accepted redundant frame. Every previous input and assertion remains exercised, including more than the real tracking cap and exact recovered bytes.

Verification

• Full workspace build, health, lint, formatting, typecheck and security audit passed; no known dependency vulnerabilities.
• Documentation maintenance: all 103 dated pages checked, zero findings.
• Collector regression tests: six passed, including beyond-100 sampling, duplicate heads, multi-page jobs, partial evidence and bounded repeated-page history.
• Live collector recovered 20 unique full-scope and 20 targeted run samples. The historical July performance budget still reports genuine differences; it is not changed by this PR. The retained report and documented review identify optical-codec mutation and wallet coverage as principal costs. This PR does not close the broader [Maintenance] Validate Sonar administration and continue CI efficiency review #402 performance program.
• Air-gap: all 141 tests passed. The deterministic tracking-cap test improved locally from 1,264ms to 356ms. Full current mutation run: 354 mutants, 89.55% score (289 killed, 28 timed out, 37 survived), passing the unchanged ratchet. It completed in 5m26s locally; hosted timing remains to be measured and is not equated with a workstation benchmark.
• uv lock --check passed with uv 0.12.1. Complete TypeScript/Go/Python code generation is reproducible: nine committed files unchanged.
• Dependabot's current upstream file fetcher and updater confirm the exact ancestor-file misclassification and path filtering; actual hosted updater retry follows integration.
• Complete diff self-reviewed: bounded APIs, diagnostics without secrets, sample integrity, dependency ownership, CI toolchain reproducibility, test strength and current/historical documentation claims.
• No public package/runtime bytes, dependencies, migration or deployed behavior changed; no package bump required.
• No analyzer suppression, removed test, reduced property count, timeout relaxation or changed regression budget.
• Hosted exact-head CI, CodeQL, zero-new-Sonar findings and review-thread completion. Keep draft until complete.

Follow-through

After integration, rerun maintenance deadlines, performance reporting and affected dependency updates; retain their actual outcomes. Review the July-to-September workload changes before any separately justified baseline refresh. Release acceptance remains a complete main run after all correctness fixes are merged.

Hosted targeted-build follow-up: the conformance TypeScript runner now declares its existing wallet-toolbox dependency. CI previously selected the runner after an air-gap change but omitted wallet declaration build prerequisites. A clean wallet declaration removal reproduces the six missing-module errors; building only the runner workspace dependency closure then passes typecheck. Full health, lint, format and typecheck also pass. This adds no registry dependency or runtime API change.

Final hosted acceptance: CI 35809336201 and all applicable external checks passed at 2d0f9a82cbd4f83dc63d6e463fdf9ab76d7b7a93; zero new Sonar findings, no open CodeQL alerts or review threads. The optical-codec mutation job completed successfully in 16m30s on Linux, while the previous weekly target was cancelled at the 20-minute job limit. This is operational evidence, not a controlled benchmark against identical source. Main advanced only through separately reviewed #560 fork-reporting behavior, which does not alter this same-repository runtime path; the combined main will receive full release acceptance.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!