chore: Use pnpm instead of npm and npx in the gate, hooks and Squad skill

[mpaulosky]

Requested by Matthew · project thread

Why

Before: if markdownlint-cli2 isn't installed and pnpm isn't on PATH, scripts/gate.sh still has an npx fallback for Markdown lint. The pre-commit hook still mentions npm install -g, and the Squad tailwind-migration skill tells agents to run npm and npx.

After: nothing uses npm or npx. Without markdownlint-cli2, the gate lints with pnpm dlx. If pnpm is missing too, the gate stops with "Markdown lint needs pnpm: corepack enable pnpm, or pnpm add -g markdownlint-cli2". The pre-commit hint now suggests only pnpm add -g markdownlint-cli2, and the skill uses pnpm.

What changed

• The first commit is the output of the repo-ci-baseline Template's apply.sh after mpaulosky/dotfiles#66 (chore: apply repo-ci-baseline Template). It overwrites scripts/gate.sh, .github/hooks/pre-commit and .github/hooks/tests/pre-push.test.sh. The hook tests now stub pnpm and check that npx is never called.
• The same Apply brings in two earlier Template changes this repo didn't have yet:
  • .github/hooks/pre-push refuses to push a branch that is behind origin/main, and docs/PROCESS.md documents this.
  • .github/scripts/release_post.py and its tests keep code exactly as written in release posts.
• The Apply also writes the Seed file docs/SECURITY.md, which this repo didn't have.
• The second commit changes the Squad skill .github/skills/tailwind-migration/SKILL.md from npm install, npx and npm run to pnpm install, pnpm dlx and pnpm run. A later squad upgrade may put the npm text back.

Verification

• I ran scripts/gate.sh on this branch in a fresh worktree. Lint and the Release build passed, and so did six of the seven test projects: Api.Tests.Integration, Api.Tests.Unit, Architecture, Shared.Tests.Unit, Web.Tests.Bunit and Web.Tests.Unit.
• AppHost.Tests.E2E failed locally, with 36 of 54 tests failing. Without the TEST_ENV secret, which only CI supplies, the web app throws "Auth0:Domain configuration is missing". This PR changes no test or source file.
• The pushed commits are the ones I gated, and origin/main hadn't moved since.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LiSLjmGJYMzJUH9kM6FyaF

---

Generated by Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

The Sandcastle path bypasses the freshness check, and the migration skill invokes an isolated, potentially incompatible Tailwind CLI.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Check branch freshness before allowing the Sandcastle fast path · New
• Use pnpm exec to invoke the project-local Tailwind CLI · New

What changed in this PR

Standardizes pnpm usage while applying baseline hook, security-documentation, and release-post hardening updates.

Changes:

• Replaces npm/npx fallbacks with pnpm commands.
• Adds branch freshness enforcement and security documentation.
• Hardens release-post Markdown processing with extensive tests.

File	Description
scripts/​gate.sh	Uses pnpm for Markdown lint fallback.
docs/​SECURITY.md	Adds the security policy.
docs/​PROCESS.md	Documents branch freshness checks.
.github/​skills/​tailwind-migration/​SKILL.md	Converts Tailwind commands to pnpm.
.github/​scripts/​release_post.py	Sanitizes generated release content.
.github/​scripts/​tests/​test_release_post.py	Adds sanitizer and link-processing tests.
.github/​hooks/​tests/​pre-push.test.sh	Tests pnpm and branch freshness behavior.
.github/​hooks/​pre-push	Adds the origin/main freshness check.
.github/​hooks/​pre-commit	Updates the Markdown lint installation hint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Fence detection incorrectly treats non-ASCII whitespace as a valid closer, causing code content to be lost or reclassified.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Check branch freshness before allowing the Sandcastle fast path
• Use pnpm exec to invoke the project-local Tailwind CLI

Previously missed (1)

In code that hasn't changed since last review

Reject non-ASCII whitespace after closing code fences

.github/​scripts/​release_post.py:462

closes_fence() uses info.strip(), so a closing fence followed by a non-breaking space is accepted even though CommonMark permits only ASCII spaces/tabs there. For example, sanitizing ```\na\n```<NBSP>\n<b> drops the apparent closer and moves/escapes <b> as prose instead of preserving both lines as code. Restrict the closer's trailing whitespace check to " \t" and add this case to the code-preservation tests.

[Copilot]

Copilot review overview

🟢 Approval recommended

Both documentation changes are consistent, valid, and introduce no unresolved functional issues.

Review effort: Balanced
Findings: None

[Copilot]

Copilot review overview

🟡 Changes recommended

The PR metadata claims absent changes, and the security document violates the numbered-list convention.

Review effort: Balanced
Findings: 2

Open (2)

• Align PR description with the actual diff · New
• Use 1. prefixes for all numbered-list items · New