chore(deps): drop redundant deps, stop committing tarballs, cache docs CI

[spboyer]

Summary

Three low-risk dependency cleanups bundled into one zero-behavior-change chore PR:

1. Drop playwright from root devDependencies (kept @playwright/test, which already bundles the runner — declaring both forces npm to resolve the bare package as a duplicate install path).
2. Drop esbuild from packages/squad-cli/devDependencies. The CLI build script (tsc -p tsconfig.json && cpSync(src/remote-ui, dist/remote-ui)) does not invoke esbuild. The two source-level mentions (packages/squad-sdk/src/build/bundle.ts, packages/squad-sdk/src/build/ci-pipeline.ts) are configuration templates that emit npx esbuild ... strings for downstream consumers — they do not import the package.
3. Delete the two committed pre-built tarballs (packages/squad-cli/bradygaster-squad-cli-0.8.25-build.10.tgz, packages/squad-sdk/bradygaster-squad-sdk-0.8.25-build.10.tgz — ~840 KB combined and stale: the project is at 0.9.4). Add packages/**/*.tgz to .gitignore so they cannot return. Future insider tarballs should be published to GitHub Releases / npm, not committed.
4. Switch the docs-quality job in .github/workflows/squad-ci.yml from uncached npm install --no-save markdownlint-cli2 cspell to cached npm ci. Both tools are already declared in root devDependencies, so the separate install was redundant.

What Changed

• package.json: removed "playwright": "^1.58.2".
• packages/squad-cli/package.json: removed "esbuild": "^0.25.0".
• package-lock.json: regenerated to drop the direct devDep entries (transitive mentions of playwright / esbuild remain — they are pulled in by other packages and are unaffected).
• .gitignore: appended packages/**/*.tgz.
• Deleted packages/squad-cli/bradygaster-squad-cli-0.8.25-build.10.tgz and packages/squad-sdk/bradygaster-squad-sdk-0.8.25-build.10.tgz.
• .github/workflows/squad-ci.yml: docs-quality job now setup-node with cache: 'npm', npm ci instead of npm install --no-save.

Testing

• npm run lint clean.
• npm run build succeeds for both packages without esbuild available.
• npm pack on each workspace still produces a tarball (now in .gitignore'd location).
• Existing scheduler/resolution/agent tests all pass unchanged (no source code changed).

Notes

This PR is part of a small five-PR series capturing low-risk performance improvements found while reviewing the repo against the current main. The PRs are designed to land independently; this one has no code/behavior changes so it is the safest to merge first.

Companion PRs:

• bench runner infrastructure
• resolution cache + multi-squad config dedupe
• parallel charter discovery with bounded concurrency
• non-blocking scheduler script execution

[Copilot]

Pull request overview

This PR is described as dependency/repository cleanup, but the actual diff also adds substantial CI automation, new CLI functionality, docs/templates, tests, and release/versioning changes across the repo.

Changes:

• Removes/updates dependency declarations, package versions, lockfile entries, changesets, tarball tracking, and changelog content.
• Adds repo-health, readiness, impact, nudge, scope, docs-link, bootstrap/security/architecture scripts and workflows.
• Adds/updates product code, docs, templates, tests, and a new squad skill command/APM integration.

Show a summary per file

File	Description
.gitignore	Ignores package tarballs.
.github/copilot-instructions.md	Documents PR nudge automation.
.github/workflows/squad-ci.yml	Switches docs quality install path to cached npm install/ci flow.
.github/workflows/squad-docs-links.yml	Adds docs link-check workflow.
.github/workflows/squad-impact.yml	Adds PR impact analysis workflow.
.github/workflows/squad-npm-publish.yml	Adjusts lockfile integrity check.
.github/workflows/squad-pr-nudge.yml	Adds stale PR nudge workflow.
.github/workflows/squad-pr-readiness.yml	Adds PR readiness workflow.
.github/workflows/squad-repo-health.yml	Adds repo-health review workflow.
.github/workflows/squad-scope-check.yml	Adds repo-health scope guard.
.squad-templates/squad.agent.md	Updates coordinator template behavior and references.
.squad-templates/workflow-wiring-appendix-a-code-reviewer.md	Adds workflow wiring appendix.
.squad-templates/workflow-wiring-appendix-b-documenter.md	Adds workflow wiring appendix.
.squad-templates/workflow-wiring-guide.md	Adds workflow wiring guide.
.squad/skills/fact-checking/SKILL.md	Adds fact-checking skill.
.squad/templates/agents/challenger.md	Adds Challenger agent template.
.changeset/*	Deletes many consumed changesets and adds new release notes.
CHANGELOG.md	Adds 0.9.4 changelog heading.
docs/src/content/docs/features/state-backends.md	Adds state backend documentation.
docs/src/content/docs/reference/sdk.md	Updates API reference link.
docs/src/navigation.ts	Updates SDK API Reference slug.
index.cjs	Renames import force flag variable.
package.json	Bumps version and removes root Playwright dev dependency.
package-lock.json	Updates versions/dependency lock entries.
packages/squad-cli/package.json	Bumps version, pins SDK dependency, removes esbuild dev dependency.
packages/squad-cli/src/cli-entry.ts	Registers new skill command.
packages/squad-cli/src/cli/commands/skill.ts	Adds APM skill publish/install/list command.
packages/squad-cli/src/cli/commands/watch/agent-spawn.ts	Adds shared watch agent-spawn helper.
packages/squad-sdk/package.json	Bumps SDK version.
packages/squad-sdk/src/platform/detect.ts	Allows dots in GitHub/Azure repo parsing.
scripts/analyze-impact.mjs	Adds PR impact analysis script.
scripts/architectural-review.mjs	Adds architectural review script.
scripts/check-bootstrap-deps.mjs	Adds bootstrap dependency guard.
scripts/check-squad-leakage.mjs	Adds .squad/ leakage detector.
scripts/impact-utils/parse-diff.mjs	Adds diff parsing helpers.
scripts/impact-utils/report-generator.mjs	Adds impact report generator.
scripts/impact-utils/risk-scorer.mjs	Adds impact risk scoring.
scripts/pr-readiness.mjs	Adds PR readiness checks/comment orchestration.
scripts/repo-health-comment.mjs	Adds shared repo-health PR comment utility.
scripts/security-review.mjs	Adds security review script.
test/cli/init.test.ts	Moves temp test root to OS temp directory.
test/cli/loop.test.ts	Updates expected CLI error text.
test/cli/upgrade.test.ts	Moves temp root and removes customization-warning tests.
test/comms-teams-integration.test.ts	Updates expected token refresh warning.
test/cross-package-exports.test.ts	Adds SDK export smoke tests.
test/migrate-directory.test.cjs	Updates .NET workflow tests to use upgrade.
test/platform-adapter.test.ts	Adds dotted repo-name parser coverage.
test/scripts/parse-diff.test.ts	Adds diff parsing tests.
test/scripts/risk-scorer.test.ts	Adds risk scorer tests.
test/scripts/security-review-skills.test.ts	Deletes skill security scanner tests.
test/scripts/security-review.test.ts	Removes skill scanner categories from expected set.
test/template-sync.test.ts	Runs template sync before template comparisons.
packages/squad-cli/bradygaster-squad-cli-0.8.25-build.10.tgz	Deletes committed tarball.
packages/squad-sdk/bradygaster-squad-sdk-0.8.25-build.10.tgz	Deletes committed tarball.

Copilot's findings

Comments suppressed due to low confidence (1)

.squad-templates/squad.agent.md:918

• This points coordinators at .squad/templates/workflow-wiring-guide.md, but this PR only adds the guide under .squad-templates/; the current .squad/templates/ tree does not contain it. Until the file is installed/copied into the path referenced here, agents following this instruction will hit a missing-file path.

7. **Wire enforcement (if applicable).** If the new member's role involves gating other agents' work (reviewer, design approver, quality gate), add a numbered enforcement rule to `routing.md` → Rules section. A routing table entry (step 6) only handles explicit requests — enforcement rules are required for automatic gates. Read `.squad/templates/workflow-wiring-guide.md` for the full wiring process, including walkthroughs for common role types (code reviewer, documenter). Check `.squad/templates/issue-lifecycle.md` for lifecycle integration if the project uses PR-gated workflows.

• Files reviewed: 68/72 changed files
• Comments generated: 24

[spboyer]

PR Checkup — feedback triaged

Status: 12 of 24 threads resolved (out-of-scope/script-and-workflow bugs to be addressed in a focused repo-health PR + rebase). 12 threads left open intentionally — they require author judgment:

• Was removing the .copilot/skills / .squad/skills scanner from security-review.mjs intentional?
• New squad skill command — convention (SKILL.md vs apm.yml), missing tests, dead code (agent-spawn.ts:6), path traversal vulnerability (skill.ts:386)
• .squad-templates/ files need mirror copies
• Removed CWD check in .squad-templates/squad.agent.md breaks monorepo init
• Doc page state-backends.md not in NAV_SECTIONS
• Reference to non-existent .squad/skills/mcp-tool-discovery/SKILL.md
• Meta scope thread on cli-entry.ts:907 — PR diff (~70 files) does not match "dep hygiene" title

Root cause: PR was branched from stale main (37 commits ahead, 41 commits behind dev). The actual dep-hygiene change is buried under unrelated commits.

Recommended next step: restructure into focused PRs (dep cleanup, squad skill feature, security-review changes, docs) each based on current dev.

@copilot-pull-request-reviewer — kept all design questions open for author decision; thanks for the careful review.

[spboyer]

✅ All previously-flagged review feedback has been addressed:

• Rebased onto current dev so the diff is now scoped to just dropping redundant deps + caching docs CI — earlier scope-drift comments no longer apply.
• Resolved every unresolved review thread with an explanatory reply.
• CI is green (test, Policy Gates, sdk-exports-validation, samples-build).

@copilot-pull-request-reviewer — ready for another look when you get a chance. Thanks!