ci: sync v4 workflows with CLDMV/.github v4.29.0 templates

.github/dependabot.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/automation/dependabot.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/dependabot.yml
 # @Date: 2026-05-26 00:00:00 -07:00 (1782460800)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>
@@ -80,10 +80,13 @@ updates:
             versions: [">=16"]
       groups:
           # vitest and @vitest/coverage-v8 (and other @vitest/* packages) peer
-          # each other exactly, so bumping one without the other breaks
-          # `npm ci` with an ERESOLVE. Bump the whole family together in one
-          # PR. Must come before security/patch/minor below — Dependabot
-          # assigns each update to the FIRST matching group.
+          # each other EXACTLY, so a partial bump (e.g. vitest to 5.0.0 while
+          # @vitest/coverage-v8 stays 4.1.11) breaks `npm ci` with an ERESOLVE.
+          # Bump the whole family together in one PR so the exact-peer
+          # versions never diverge. Must come before security/patch/minor
+          # below — Dependabot assigns each update to the FIRST matching
+          # group, and this one has no applies-to restriction so it always
+          # wins for vitest-family packages regardless of update type.
           vitest:
               patterns:
                   - "vitest"

.github/workflows/branch-retention.yml

@@ -21,18 +21,20 @@
 name: 🌿 Branch Retention
 
 on:
-  pull_request:
-    types: [closed]
-    branches: [master, main, next, hotfixes]
+    pull_request:
+        types: [closed]
+        branches: [master, main, next, hotfixes]
 
 permissions:
-  contents: write
-  pull-requests: read
+    contents: read
 
 jobs:
-  retain:
-    if: github.event.pull_request.merged == true
-    uses: CLDMV/.github/.github/workflows/reusable-branch-retention.yml@v4
-    secrets:
-      BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-      BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+    retain:
+        permissions:
+            contents: write
+            pull-requests: read
+        if: github.event.pull_request.merged == true
+        uses: CLDMV/.github/.github/workflows/reusable-branch-retention.yml@v4
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

.github/workflows/bundle-size.yml

@@ -0,0 +1,48 @@
+#
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/bundle-size.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran <CLDMV>
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/bundle-size.yml
+#
+# Only relevant for runtime libraries where bundle size matters (e.g.
+# @cldmv/slothlet). Skip this template for tool repos / meta repos.
+#
+# Fork-PR caveat: builds PR-supplied code, so we use `pull_request`
+# (NOT pull_request_target). Fork builds run safely without secrets;
+# comment posting fails for fork PRs because the token is read-only.
+# Maintainer can run via workflow_dispatch after reviewing the code.
+#
+# Batch 5.4 from tmp/plan-future-workflows.md.
+name: 📊 Bundle Size
+
+on:
+    pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
+        branches: [master, main]
+    workflow_dispatch:
+
+permissions:
+    contents: read
+    pull-requests: write
+
+jobs:
+    diff:
+        uses: CLDMV/.github/.github/workflows/reusable-bundle-size.yml@v4
+        with:
+            build_command: "npm run build:ci"
+            dist_paths: "bin/**,src/**,hooks/**,messages/**,docs/**"
+            # warning_pct: 5
+            # warning_bytes: 500
+            # comment_mode: "update"
+        # Optional. Without these, the size-diff comment is posted by
+        # github-actions[bot]. With these, it's posted by your CLDMV bot App.
+        # Note: fork PRs can't access org secrets, so the bot attribution only
+        # applies to same-repo PRs; fork PRs fall back to GITHUB_TOKEN.
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}