Clean refactor — the dedup is well done and all the conversions are functionally equivalent. Two things worth noting:

GHAS alerts on setup-node-pnpm: The rationale for keeping bonk.yml/bigbonk.yml inline is sound. Those are issue_comment-triggered with contents: write, so referencing local composite actions creates a TOCTOU vector where a malicious PR could modify the action before checkout. The existing GHAS alerts on build-vinext and deploy-example are pre-existing (from deploy-preview-command.yml, also issue_comment-triggered) — this PR doesn't make that worse.

registry-url default of "": The actions/setup-node action treats an empty string for registry-url as "don't configure a registry", so passing through the empty default works correctly. Only publish.yml sets it to the npm registry, which is the right behavior.

Specific observations on each change:

1. Composite action — Correct 1:1 replacement. Every inline triplet used node-version: 24, cache: pnpm, and --frozen-lockfile, which is exactly what the action defaults to.

2. publish.yml working-directory removal — The old workflow ran pnpm run build with working-directory: packages/vinext. The new version runs pnpm run build at the repo root, which delegates via pnpm --filter vinext run build in the root package.json. Functionally equivalent.

3. create-next-app CJS→bash — The bash version using curl + kill is simpler and more readable. One behavioral difference: the old Node version used taskkill on Windows for process cleanup. Since both ubuntu-latest and windows-latest runners now use shell: bash, and kill works on Windows bash (Git Bash / MSYS2), this is fine. The kill "$SERVER_PID" 2>/dev/null || true pattern handles the case where the process already exited.

4. ecosystem-run.yml CJS→ESM — node --input-type=module with heredoc is the correct way to run ESM from stdin. The old node - approach used CJS require() which works but is deprecated-path. The require('./packages/vinext/package.json') → readFileSync + JSON.parse is necessary because JSON imports need assertions in ESM. Functionally equivalent.

5. Playwright cache — Cache key playwright-chromium-${{ runner.os }}-${{ hashFiles('**/package.json') }} is reasonable. The playwright install chromium command is idempotent — if the cache hits and the version matches, it's a no-op. If Playwright gets bumped, package.json changes and the cache misses. The glob **/package.json is broad (includes fixtures/examples) but that's fine — better to over-invalidate than under.

6. Deploy concurrency group — deploy-${{ github.event_name }}-${{ github.ref }} means push-to-main and PR deploys get separate groups, and multiple pushes to the same PR cancel previous runs. Correct.

7. Whitespace cleanup in deploy-examples.yml — trailing spaces removed in the JS script block. Purely cosmetic.

LGTM.