Summary

• pin third-party GitHub Actions and disable checkout credential persistence in blocking workflows
• add a real macOS desktop smoke gate that launches the Electron app and waits for a CI-ready signal
• keep the non-blocking e2e artifacts workflow useful, and add Dependabot coverage plus workflow contract tests

Why

The goal of #38 is to make CI a trustworthy PR quality gate instead of a loose collection of workflows. This PR hardens the blocking checks, makes the desktop smoke workflow validate an actual app launch path, and keeps diagnostic e2e coverage visible without turning it into a flaky merge blocker.

Related Issue

Closes #38

How To Verify

bun test scripts/ci-smoke.test.ts src/preload/runtime-flags.test.ts src/renderer/ci-smoke-selectors.test.ts
bun test test/github/desktop-smoke-workflow.test.ts test/github/ci-workflow.test.ts test/config/e2e-artifacts-workflow.test.ts
bun --cwd packages/app test:e2e:local:smoke
bun run build
bun run smoke:ci

Screenshots or Recordings

N/A, no visible UI changes.

Checklist

• I ran the relevant verification steps
• I tested visible changes manually when needed
• I am targeting the dev branch