deps: bump vitest from 5.0.1 to 5.0.2 in the vitest group

.configs/fix-headers.json

@@ -0,0 +1,3 @@
+{
+	"extends": "@cldmv/configs/fix-headers.json"
+}

.configs/vitest.config.mjs

@@ -1,3 +1,18 @@
+/**
+ *
+ *	@Project: gitmulti
+ *	@Filename: /.configs/vitest.config.mjs
+ *	@Date: 2026-08-02T16:42:01-07:00 (1785714121)
+ *	@Author: Nate Corcoran <CLDMV>
+ *	@Email: <Shinrai@users.noreply.github.com>
+ *	-----
+ *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+ *	@Last modified time: 2026-10-02T11:30:27-07:00 (1790965827)
+ *	-----
+ *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+ *
+ */
+
 import { defineConfig } from "vitest/config";
 import { fileURLToPath } from "node:url";
 import path from "node:path";

.github/dependabot.yml

@@ -1,10 +1,14 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/automation/dependabot.yml
-# @Date: 2026-05-26 00:00:00 -07:00 (1782460800)
-# @Author: Nate Corcoran <CLDMV>
-# @Email: <Shinrai@users.noreply.github.com>
-# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#	@Project: gitmulti
+#	@Filename: /.github/dependabot.yml
+#	@Date: 2026-05-26T00:00:00-07:00 (1779778800)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:28-07:00 (1790965828)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
 #
 
 # Individual repo: .github/dependabot.yml
@@ -69,10 +73,13 @@ updates:
           prefix: "deps"
       groups:
           # vitest and @vitest/coverage-v8 (and other @vitest/* packages) peer
-          # each other exactly, so bumping one without the other breaks
-          # `npm ci` with an ERESOLVE. Bump the whole family together in one
-          # PR. Must come before security/patch/minor below — Dependabot
-          # assigns each update to the FIRST matching group.
+          # each other EXACTLY, so a partial bump (e.g. vitest to 5.0.0 while
+          # @vitest/coverage-v8 stays 4.1.11) breaks `npm ci` with an ERESOLVE.
+          # Bump the whole family together in one PR so the exact-peer
+          # versions never diverge. Must come before security/patch/minor
+          # below — Dependabot assigns each update to the FIRST matching
+          # group, and this one has no applies-to restriction so it always
+          # wins for vitest-family packages regardless of update type.
           vitest:
               patterns:
                   - "vitest"

.github/workflows/branch-retention.yml

@@ -1,10 +1,14 @@
 #
-# @Project: gitmulti
-# @Filename: /.github/workflows/branch-retention.yml
-# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
-# @Author: Nate Corcoran <CLDMV>
-# @Email: <Shinrai@users.noreply.github.com>
-# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#	@Project: gitmulti
+#	@Filename: /.github/workflows/branch-retention.yml
+#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:28-07:00 (1790965828)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
 #
 
 # Individual repo: .github/workflows/branch-retention.yml
@@ -26,11 +30,13 @@ on:
         branches: [master, main, next, hotfixes]
 
 permissions:
-    contents: write
-    pull-requests: read
+    contents: read
 
 jobs:
     retain:
+        permissions:
+            contents: write
+            pull-requests: read
         if: github.event.pull_request.merged == true
         uses: CLDMV/.github/.github/workflows/reusable-branch-retention.yml@v4
         secrets:

.github/workflows/bundle-size.yml

@@ -0,0 +1,53 @@
+#
+#	@Project: gitmulti
+#	@Filename: /.github/workflows/bundle-size.yml
+#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:28-07:00 (1790965828)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/bundle-size.yml
+#
+# Only relevant for runtime libraries where bundle size matters (e.g.
+# @cldmv/slothlet). Skip this template for tool repos / meta repos.
+#
+# Fork-PR caveat: builds PR-supplied code, so we use `pull_request`
+# (NOT pull_request_target). Fork builds run safely without secrets;
+# comment posting fails for fork PRs because the token is read-only.
+# Maintainer can run via workflow_dispatch after reviewing the code.
+#
+# Batch 5.4 from tmp/plan-future-workflows.md.
+name: 📊 Bundle Size
+
+on:
+    pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
+        branches: [master, main]
+    workflow_dispatch:
+
+permissions:
+    contents: read
+    pull-requests: write
+
+jobs:
+    diff:
+        uses: CLDMV/.github/.github/workflows/reusable-bundle-size.yml@v4
+        with:
+            build_command: "npm run build:ci"
+            # Leading `*` is required: the measure step only walks directories, so a bare top-level filename matches nothing.
+            dist_paths: "*gitmulti.js"
+            # warning_pct: 5
+            # warning_bytes: 500
+            # comment_mode: "update"
+        # Optional. Without these, the size-diff comment is posted by
+        # github-actions[bot]. With these, it's posted by your CLDMV bot App.
+        # Note: fork PRs can't access org secrets, so the bot attribution only
+        # applies to same-repo PRs; fork PRs fall back to GITHUB_TOKEN.
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}