[ECorreia45]

Summary

• Add a deterministic default-branch health-repair path for npm-generated lock synchronization and formatting-only edits to existing workflow YAML, with duplicate-PR prevention and draft review
• Preserve the existing dependency merge policy; repair up to three failing same-repository dependency PRs instead of only one
• Keep AI edits out of workflows, lockfiles, secrets and policy files using protected-content, Git HEAD/index, file-mode and post-validation guards
• Fail visibly on hard provider/quota errors even if aider returns exit code zero; do not hide repair failures with continue-on-error
• Retain current token permissions, disable persisted checkout credentials, strip token variables from package tools, and use a command-local credential helper only for publication

Repository-specific repair and verification

• Apply Prettier-only changes to four source files that previously caused 19 lint errors; no runtime behavior changes
• Local lint now has no errors (existing warnings remain), all 15 suites / 111 tests and 30 snapshots pass, and build passes on Node 22 and Node 24

Maintenance verification

• 33 guard tests pass, including actual Git fixtures, YAML 1.2 scalar/semantic checks, duplicate keys, protected/index/HEAD/mode/symlink mutations, npm-only lock generation, provider-error handling, credential scrubbing and validation-failure propagation
• Shell syntax and workflow parsing pass; existing token permissions are unchanged
• New guard-test CI runs on maintenance pull requests with read-only contents access

Review and remaining limits

This is a draft for review. No merge, release, live maintenance run or paid provider request was performed. The scheduled automation does not change until this PR is merged. Exact-head GitHub checks must still be reviewed. GitHub may require maintainer approval for token-created PR runs, and existing token/org restrictions may reject workflow-file pushes or PR creation; those failures remain explicit, with a repair patch artifact where available. These are publication guards, not a sandbox for running repository code.