dependency-triage

Use for a Codex dependency sweeper triage loop that watches advisories and lockfiles, proposes patch-only updates, rejects major upgrades without approval, and records reproducible verification commands.