Fix existing-database upgrades and strengthen cross-platform toolkit CI

.agents/skills/ci-prep/SKILL.md

@@ -3,7 +3,7 @@ name: ci-prep
 description: Prepares the current branch for CI by running the exact same steps locally and fixing issues. If CI is already failing, fetches the GH Actions logs first to diagnose. Use before pushing, when CI is red, or when the user says "fix ci".
 argument-hint: "[--failing] [optional job name to focus on]"
 ---
-<!-- agent-pmo:74cf183 -->
+<!-- agent-pmo:795a9c2 -->
 
 # CI Prep
 

.agents/skills/code-dedup/SKILL.md

@@ -2,7 +2,7 @@
 name: code-dedup
 description: Searches for duplicate code, duplicate tests, and dead code, then safely merges or removes them. Use when the user says "deduplicate", "find duplicates", "remove dead code", "DRY up", or "code dedup". Requires test coverage — refuses to touch untested code.
 ---
-<!-- agent-pmo:74cf183 -->
+<!-- agent-pmo:795a9c2 -->
 
 # Code Dedup
 

.agents/skills/fix-bug/SKILL.md

@@ -4,7 +4,7 @@ description: Fix a bug using test-driven development. Use when the user reports
 argument-hint: "[bug description]"
 allowed-tools: Read, Grep, Glob, Edit, Write, Bash
 ---
-<!-- agent-pmo:74cf183 -->
+<!-- agent-pmo:795a9c2 -->
 
 # Bug Fix Skill — Test-First Workflow
 

.agents/skills/spec-check/SKILL.md

@@ -3,7 +3,7 @@ name: spec-check
 description: Audit spec/plan documents against the codebase. Ensures every spec section has implementing code, tests, and matching logic. Use when the user says "check specs", "spec audit", or "verify specs".
 argument-hint: "[optional spec ID or filename filter]"
 ---
-<!-- agent-pmo:74cf183 -->
+<!-- agent-pmo:795a9c2 -->
 
 # spec-check
 

.agents/skills/submit-pr/SKILL.md

@@ -3,7 +3,7 @@ name: submit-pr
 description: Creates a pull request with a well-structured description after verifying CI passes. Use when the user asks to submit, create, or open a pull request.
 disable-model-invocation: true
 ---
-<!-- agent-pmo:74cf183 -->
+<!-- agent-pmo:795a9c2 -->
 
 # Submit PR
 

.agents/skills/upgrade-packages/SKILL.md

@@ -3,7 +3,7 @@ name: upgrade-packages
 description: Upgrade all dependencies/packages to their latest versions for the detected language(s). Use when the user says "upgrade packages", "update dependencies", "bump versions", "update packages", or "upgrade deps".
 argument-hint: "[--check-only] [--major] [package-name]"
 ---
-<!-- agent-pmo:74cf183 -->
+<!-- agent-pmo:795a9c2 -->
 
 # Upgrade Packages
 

.agents/skills/website-audit/SKILL.md

@@ -2,7 +2,7 @@
 name: website-audit
 description: Audits a website for SEO, AI search performance, structured data, mobile usability, broken links, and social media cards. Fixes issues found. Use when the user mentions "audit website", "SEO", "fix search ranking", "AI search", "structured data", "social media cards", or "website performance".
 ---
-<!-- agent-pmo:74cf183 -->
+<!-- agent-pmo:795a9c2 -->
 
 # Website Audit
 

.claude/settings.local.json

@@ -0,0 +1,9 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(make fmt-check *)",
+      "Bash(gh issue *)"
+    ]
+  },
+  "autoMemoryEnabled": false
+}

.clinerules/00-read-instructions.md

@@ -1,2 +1,2 @@
-<!-- agent-pmo:74cf183 -->
+<!-- agent-pmo:795a9c2 -->
 @CLAUDE.md

.csharpierrc.json

@@ -0,0 +1 @@
+{}

.deslop.toml

@@ -0,0 +1,36 @@
+# agent-pmo:795a9c2
+# Deslop duplication gate — REPO-STANDARDS-SPEC [CI-DESLOP]
+# Single source of truth for this repo's duplication budget.
+# Docs: https://deslop.live/docs/for-ai/
+[defaults]
+# Generated ANTLR outputs cannot be deduplicated by hand. Excluding them before
+# analysis also avoids comparing millions of generated parser subtrees.
+exclude = [
+  # Reporting is outside the requested duplication audit scope.
+  "Reporting/**",
+  "DataProvider/Nimblesite.DataProvider.Postgres/Parsing/PostgreSQLLexer.cs",
+  "DataProvider/Nimblesite.DataProvider.Postgres/Parsing/PostgreSQLParser.cs",
+  "DataProvider/Nimblesite.DataProvider.Postgres/Parsing/PostgreSQLParserBaseListener.cs",
+  "DataProvider/Nimblesite.DataProvider.Postgres/Parsing/PostgreSQLParserBaseVisitor.cs",
+  "DataProvider/Nimblesite.DataProvider.Postgres/Parsing/PostgreSQLParserListener.cs",
+  "DataProvider/Nimblesite.DataProvider.Postgres/Parsing/PostgreSQLParserVisitor.cs",
+  "DataProvider/Nimblesite.DataProvider.SQLite/Parsing/SQLiteLexer.cs",
+  "DataProvider/Nimblesite.DataProvider.SQLite/Parsing/SQLiteParser.cs",
+  "DataProvider/Nimblesite.DataProvider.SQLite/Parsing/SQLiteParserBaseListener.cs",
+  "DataProvider/Nimblesite.DataProvider.SQLite/Parsing/SQLiteParserBaseVisitor.cs",
+  "DataProvider/Nimblesite.DataProvider.SQLite/Parsing/SQLiteParserListener.cs",
+  "DataProvider/Nimblesite.DataProvider.SQLite/Parsing/SQLiteParserVisitor.cs",
+  "Lql/Nimblesite.Lql.Core/Parsing/LqlBaseListener.cs",
+  "Lql/Nimblesite.Lql.Core/Parsing/LqlBaseVisitor.cs",
+  "Lql/Nimblesite.Lql.Core/Parsing/LqlLexer.cs",
+  "Lql/Nimblesite.Lql.Core/Parsing/LqlListener.cs",
+  "Lql/Nimblesite.Lql.Core/Parsing/LqlParser.cs",
+  "Lql/Nimblesite.Lql.Core/Parsing/LqlVisitor.cs",
+  "Lql/lql-lsp-rust/crates/lql-parser/src/generated/**",
+]
+
+[threshold]
+# Initial adoption ceiling measured with Deslop 0.36.0; main was 44.20213%.
+# Written justification and reproduction: docs/specs/ci-spec.md [CI-DESLOP-BASELINE].
+# Keep all findings visible. Subsequent changes may only ratchet this DOWN.
+max_duplication_percent = 39.44

.github/copilot-instructions.md

@@ -1,2 +1,2 @@
-<!-- agent-pmo:74cf183 -->
+<!-- agent-pmo:795a9c2 -->
 @CLAUDE.md

.github/dependabot.yml

@@ -0,0 +1,72 @@
+# agent-pmo:795a9c2
+# Dependabot — supply-chain defense without PR spam, and without burning CI on
+# `main` for routine bumps. Portfolio standard ([GITHUB-DEPENDABOT]).
+#
+# Routine VERSION bumps target the long-lived `dependabot-upgrades` STAGING
+# branch (never `main`). ci.yml / codeql.yml trigger only on
+# `pull_request: [main]`, so staging PRs run NO build/test/CodeQL; they are
+# auto-merged by .github/workflows/dependabot-automerge.yml. The batch reaches
+# `main` through ONE consolidation PR where CI/CodeQL run exactly once.
+# SECURITY updates ignore `target-branch` and still open against `main`.
+#
+# Ecosystems kept = the manifests THIS repo actually has: nuget (.csproj/.fsproj),
+# cargo (Lql/lql-lsp-rust workspace), npm (root + Website + LqlExtension +
+# LqlWebsite-Eleventy), and github-actions. No Python/Dart/Go manifests exist.
+#
+# REQUIREMENT: the `dependabot-upgrades` branch must exist and carry
+# dependabot-automerge.yml (cut from main AFTER both land on main).
+version: 2
+
+updates:
+  # GitHub Actions — every repo with workflows. Pinned actions are a prime
+  # supply-chain target, so keep them current.
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: "dependabot-upgrades"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels: ["dependencies"]
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  # NuGet / .NET — *.csproj, *.fsproj across the solution.
+  - package-ecosystem: nuget
+    directory: /
+    target-branch: "dependabot-upgrades"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels: ["dependencies"]
+    groups:
+      nuget:
+        patterns: ["*"]
+
+  # Cargo / Rust — the LQL LSP workspace.
+  - package-ecosystem: cargo
+    directory: /Lql/lql-lsp-rust
+    target-branch: "dependabot-upgrades"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels: ["dependencies"]
+    groups:
+      cargo:
+        patterns: ["*"]
+
+  # npm / Node — root tooling + both Eleventy sites + the VS Code extension.
+  - package-ecosystem: npm
+    directories:
+      - "/"
+      - "/Website"
+      - "/Lql/LqlExtension"
+      - "/Lql/LqlWebsite-Eleventy"
+    target-branch: "dependabot-upgrades"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels: ["dependencies"]
+    groups:
+      npm:
+        patterns: ["*"]