Certify pm-github on PM CLI 2026.10.4 and consolidate pending dependency updates

.agents/pm/chores/pm-github-julo.toon

@@ -0,0 +1,81 @@
+id: pm-github-julo
+title: Certify pm-github on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates
+description: "Raise the exact development pin @unbrained/pm-cli to 2026.10.4 together with pm-ops 2026.10.4 (pm-changelog already at 2026.9.25); consolidate Dependabot #101 (pm-cli), #102 (@types/node), #103 (pm-ops) and #104 (codeql-action pinned SHA group 2892aa5); keep the canonical pm-ops merge-driver launcher byte-identical; certify with the full release gate plus isolated real-tracker dogfooding of the read-only GitHub surfaces via npm and Bun."
+type: Chore
+status: in_progress
+priority: 2
+tags[4]: cli,dependencies,release-readiness,sdk
+created_at: "2026-10-04T10:20:50.548Z"
+updated_at: "2026-10-04T11:51:32.498Z"
+author: pi-glm
+acceptance_criteria: "npm run release:check passes (privacy, docstring, coverage gates intact); pm health with the repo-pinned 2026.10.4 binary is clean; packed tarball exercises validate/import/export-preview/sync-preview against a real repo read-only via npx @unbrained/pm-cli@2026.10.4 and bunx with zero GitHub mutation"
+actual_result: "Exact CLI/ops/changelog 2026.10.4 and development pins; canonical launcher unchanged; isolated lookup-loop suite 8/8. Clean npm ci and serialized release:check PASS 309/309, zero skips, unchanged coverage and privacy gate passed; both audit scopes 0, no open alerts. Packed own-tracker npx/bunx read-only commands pass (108 create + 1 update export preview, sync planned 1 / wouldSync 0 / skipped 1), no GitHub writes; scratch removed. Health exits 0 with stale_in_progress_items:2 advisory and no gate-failing findings, correcting the earlier zero-warning text. CodeRabbit and Greptile substantive reviews find no new actionable issues; other required reviews unavailable/pending. Leave item and PR open."
+comments[7]{created_at,author,text}:
+  "2026-10-04T10:21:00.651Z",pi-glm,"Starting at 2daff95 (Release pm-github v2026.10.04). Plan: pm-cli 2026.9.26->2026.10.4, pm-ops 2026.9.28->2026.10.4, @types/node ->26.6.4 in range, codeql-action SHA group 1c5b6756->2892aa5 from #104; recopy canonical prepare-merge-driver.ts from pm-ops 2026.10.4; full release gate + read-only dogfood (validate/import/export dry-run/sync dry-run) + previews."
+  "2026-10-04T10:26:29.326Z",pi-glm,"Real-tracker dogfood PASS (read-only on GitHub). Packed pm-github-2026.10.4.tgz installed into a scratch copy of this repo's real .agents/pm and registered via pm package install with CLI 2026.10.4. npm path (npx -y @unbrained/pm-cli@2026.10.4): github validate --repo unbraind/pm-github -> ok (token via gh CLI, HTTP 200, quota 4813/5000); github import unbraind/pm-github -> no open issues found (truthful, both this repo and unbraind/pm-csv have zero open issues); github import unbraind/pm-cli -> Imported 26 new (real open issue data fetched read-only); re-import -> 0 new / 26 updated proving gh:owner/repo#N provenance idempotency; github export --dry-run -> create/update plan only, writes nothing; github sync --dry-run --repo unbraind/pm-csv -> planned 0. bun path (bunx @unbrained/pm-cli@2026.10.4): github validate -> ok; github import unbraind/pm-cli -> 0 new / 26 updated; export --dry-run and sync --dry-run identical. Zero GitHub mutation (reads + local scratch writes only); scratch deleted after evidence capture."
+  "2026-10-04T10:27:47.809Z",pi-glm,"pm-github installed as managed project extension from npm at latest 2026.10.4 (self-extension registration; extensions are per-clone/gitignored). Read-only previews against unbraind/pm-github: github validate -> ok (HTTP 200, quota 4776/5000); github export --dry-run -> plan only, writes nothing; github sync --dry-run -> planned 1 / skipped 1, no mutation. No issues created/modified, no scheduled sync enabled."
+  "2026-10-04T11:08:25.648Z",codex-sol,"Resumed PR #106 after re-reading current comments/reviews. Greptile correctly requests a NODE_PATH lookup-error regression. Add the looping-symlink child-process fixture before pin updates; retain the canonical launcher. Finish exact devDependency pins and latest pm-changelog 2026.10.4, clean npm ci, full locked gate and packed read-only real-tracker npm/bun dogfood."
+  "2026-10-04T11:19:04.632Z",codex-sol,"Also applied the verified cross-repo fixture findings: Node junction type for unconditional Windows-compatible lookup fixtures, and cleared ambient NODE_PATH in the normal prepare helper while preserving the explicit looping lookup. No launcher changes, no new skips. Clean npm ci now succeeds and both audit scopes are clean."
+  "2026-10-04T11:30:44.957Z",codex-sol,"Resumption validation PASS: all devDependencies exact; CLI/ops/changelog 2026.10.4. Clean npm ci and flock-serialized npm run release:check passed 309/309, zero skips, unchanged configured coverage (2 measured sources), privacy 3052 Git objects clean, both audit scopes 0. Requested lookup-loop regression and hostile NODE_PATH fixture test pass 8/8, no skips; canonical launcher unchanged. Packed real own tracker npm/bun dogfood: npx -y @unbrained/pm-cli@2026.10.4 github validate --repo unbraind/pm-github; github import unbraind/pm-github --dry-run; github export --dry-run --repo unbraind/pm-github; github sync --dry-run --repo unbraind/pm-github; equivalent bunx @unbrained/pm-cli@2026.10.4 commands all pass. Export preview renders 108 creates + 1 update from 109 real items; sync planned 1, wouldSync 0, skipped 1; zero GitHub mutation. Scratch removed. Pinned npx pm health ok without warnings; managed pm-github 2026.10.4 own-repo sync preview returns planned 1 / wouldSync 0 / skipped 1. Review availability remains a separate gate."
+  "2026-10-04T11:51:30.969Z",codex-sol,"Final health receipt correction: the complete pinned health receipt has stale_in_progress_items:2 advisory, not zero warnings as the earlier resumption text claimed. Health exits 0 with no gate-failing findings. Existing items remain open for their owners. Package code, 309/309 full gate result, clean audits, packed read-only real-tracker dogfood and substantive CodeRabbit/Greptile reviews are unchanged."
+files[5]:
+  - path: .github/workflows/codeql.yml
+    scope: project
+    note: codeql-action pinned SHA group 2892aa5 from #104
+  - path: package-lock.json
+    scope: project
+    note: Resolved dependency graph with consolidated Dependabot bumps
+  - path: package.json
+    scope: project
+    note: Exact CLI/ops pins raised to 2026.10.4
+  - path: scripts/prepare-merge-driver.ts
+    scope: project
+    note: Canonical pm-ops 2026.10.4 launcher recopied byte-for-byte
+  - path: test/prepare-merge-driver.test.ts
+    scope: project
+tests[6]:
+  - command: "npm run release:check"
+    scope: project
+    provenance:
+      author: pi-glm
+      created_at: "2026-10-04T10:27:55.325Z"
+      source_kind: local_mutation
+      source_ref: chore/pm-github-pm-cli-2026-10-4
+  - command: npx pm health
+    scope: project
+    provenance:
+      author: pi-glm
+      created_at: "2026-10-04T10:27:56.397Z"
+      source_kind: local_mutation
+      source_ref: chore/pm-github-pm-cli-2026-10-4
+  - command: npx -y @unbrained/pm-cli@2026.10.4 github import unbraind/pm-cli
+    scope: project
+    provenance:
+      author: pi-glm
+      created_at: "2026-10-04T10:27:57.374Z"
+      source_kind: local_mutation
+      source_ref: chore/pm-github-pm-cli-2026-10-4
+  - command: bunx @unbrained/pm-cli@2026.10.4 github sync --dry-run --repo unbraind/pm-csv
+    scope: project
+    provenance:
+      author: pi-glm
+      created_at: "2026-10-04T10:27:58.293Z"
+      source_kind: local_mutation
+      source_ref: chore/pm-github-pm-cli-2026-10-4
+  - command: node --test test/prepare-merge-driver.test.ts
+    scope: project
+    pm_context_mode: tracker
+    provenance:
+      author: codex-sol
+      created_at: "2026-10-04T11:08:29.490Z"
+      source_kind: local_mutation
+      source_ref: chore/pm-github-pm-cli-2026-10-4
+  - command: "env NODE_PATH=\"$PWD/node_modules\" node --test test/prepare-merge-driver.test.ts"
+    scope: project
+    pm_context_mode: tracker
+    provenance:
+      author: codex-sol
+      created_at: "2026-10-04T11:19:02.787Z"
+      source_kind: local_mutation
+      source_ref: chore/pm-github-pm-cli-2026-10-4
+body: ""