fix: unblock quality lanes blocked by dependency resolution and Windows spawn

[ilijachrchev]

Description

Fixes three independent environment blockers that prevented the quality baseline from being measured for #469. All three are dependency/tooling issues — no application behavior changes.

1. d3-array version skew (blocked pnpm build)

d3-contour@4 imports blur2 from d3-array, but d3-sankey@0.12.3 declared "1 - 2" for d3-array, causing pnpm to hoist d3-array@2.12.1 which doesn't export blur2. Added a pnpm override "d3-array": "^3.2.0" to deduplicate the tree. d3-sankey only uses min, max, sum — all unchanged between v2 and v3.

2. minimatch hoisting (blocked unit tests + a11y)

The repo's public-hoist-pattern[]=* caused minimatch@3.1.2 (CJS-only, no named ESM exports) to be hoisted to top-level node_modules. glob@11 imports { GLOBSTAR } from minimatch, which resolved to the hoisted 3.x instead of its own nested minimatch@10.x. Added public-hoist-pattern[]=!minimatch to .npmrc so each consumer keeps its correctly versioned copy.

3. Boundary conformance .cmd spawn on Windows (blocked lint:ox:boundary-conformance)

scripts/check-boundary-decoder-conformance.mjs spawned oxlint.cmd via spawnSync without shell: true, which throws EINVAL on Node 24 + Windows. Instead of adding shell: true (which triggers DEP0190 and breaks on paths with spaces), resolved oxlint's actual JS entry point via require.resolve and spawned it with node directly. Cross-platform safe.

Verification (Windows, Node 24.14.0, pnpm 10.19.0):

Lane	Result
pnpm lint (oxlint + eslint + anti-slop + boundary-conformance + knip)	pass, 0 findings
pnpm typecheck	pass, 0 errors
pnpm build (frontend + main + electron)	pass

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have read the CONTRIBUTING.md guidelines
• My code follows the code style of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes
• I have run pnpm typecheck and pnpm lint locally

Critical Areas Modified

None.

Additional Notes

This is the first PR toward the zero-findings quality campaign (#469). It unblocks the baseline measurement so the remaining React Doctor, test, and a11y work can proceed with accurate numbers.

[parsakhaz]

Verdict: Approve — the three tooling fixes match the PR intent, preserve application behavior, and introduce no correctness or security defect.
Counts: Must Fix: 0 (security: 0) · Should Fix: 0 · pass 1/3

Must Fix

None.

Should Fix

None.

Praise

• .npmrc:10 keeps glob@11 resolved to its compatible minimatch@10.0.3; a fresh frozen install plus an ESM glob import passed.
• package.json:28 deduplicates d3-array at 3.2.4; the only formerly-v2 consumer, d3-sankey, calls only the unchanged min, max, and sum APIs.
• scripts/check-boundary-decoder-conformance.mjs:13-16,23,41 resolves Oxlint from its package manifest and launches it through process.execPath with argument arrays, avoiding both Windows .cmd spawning and shell injection/path quoting risks.
• The rebased head passed GitHub checks on Windows, macOS, and Linux, including Quality Checks + Smoke, main-process tests, React Doctor, and Socket security.

Checks run

• pnpm install --frozen-lockfile --ignore-scripts
• node scripts/check-boundary-decoder-conformance.mjs
• Fresh dependency-resolution inspection for glob, minimatch, d3-array, and d3-sankey
• git diff --check origin/main...HEAD

[parsakhaz]

Review, simplify, and refactor complete

REVIEW

• Rebasing was required: the PR was 16 commits behind main. The three original commits rebased cleanly and were force-pushed with lease.
• Correctness and security review found 0 Must-Fix and 0 Should-Fix defects. An approving GitHub review with file:line evidence is posted above.
• No fix(review): ... commit was needed.

SIMPLIFY

Commit: 53737c7a refactor(simplify): reduce dependency tooling ceremony

• Removed two one-use Oxlint process aliases.
• Reduced the minimatch hoisting explanation from six lines to two while preserving the cause and issue reference.
• Removed unrelated cron-parser lockfile metadata and normalized the .npmrc final newline.
• Net result: 13 deletions, 6 additions, no behavior change.

REFACTOR

Commit: 3f341d8d refactor(dependencies): scope d3-array override

• Narrowed the d3-array override to d3-sankey>d3-array, the only consumer whose declared range needed replacement.
• This preserves the current resolved graph while preventing the override from silently forcing future consumers that legitimately require d3-array v1 or v2.

Verification

Before simplification:

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm typecheck
• pnpm lint including blocking Oxlint, ESLint, zero advisory findings, boundary conformance, and Knip
• pnpm build including frontend, main, universal Electron packaging, icon verification, and React Scan exclusion verification
• Fresh dependency inspection confirmed glob@11 resolves minimatch@10.0.3
• Rebased-head GitHub checks passed on Windows, macOS, and Linux, including quality/smoke, main-process tests, React Doctor, and Socket security

After simplification and final refactor:

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm typecheck
• pnpm lint with 0 advisory findings and clean Knip
• node scripts/check-boundary-decoder-conformance.mjs
• pnpm build:frontend, including the d3-sankey bundle and production instrumentation checks
• Dependency graph remained on d3-array@3.2.4 for every current consumer
• git diff --check origin/main...HEAD

pr-test-automation was not run because the PR touches no UI or user flow.

Follow-ups

No code follow-ups remain from the deep refactor pass. Parsa only needs to let the final-head GitHub checks finish, review the two added commits, and merge when satisfied.