feat(portfolio): showcase live MingleStage Early Access

[writingdeveloper]

Add the now-live MingleStage free 3D watch-party MVP to featured portfolio projects with genuine product screenshot (optimized WebP, 17 KB), bilingual product summary, case-study methodology, honest synthetic-vs-human QA boundaries and direct link to https://minglestage.app/. Uses isolated Git worktree; leaves other portfolio sessions and dirty canonical changes intact.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
portfolio	Ready	Preview	Oct 18, 2026 7:51pm UTC

[writingdeveloper]

MingleStage portfolio integration is complete in this PR (44-project ledger, featured homepage slot, bilingual case study, live destination and actual optimized screenshot). Latest CI 39083390400: typecheck, lint, format, full unit tests, translation parity, image verification and Next build all PASS. The final npm audit gate FAILS due inherited pre-existing vulnerable dependencies on base main, including Next 16.0–16.3.7 critical advisory (installed version is affected), sharp/source-map-js highs and Keystatic/chokidar highs. Audit remains enabled and this PR has NOT been merged; coordinate remediation with existing security update PRs #32/#33/#35. Do not bypass the scan or count this link as live on writingdeveloper.blog until it is merged/deployed.

[writingdeveloper]

2026-10-18 PDT follow-up (same PR, all changes scoped to isolated worktree).

Security patch verified: Next.js 16.4.2 / eslint-config-next 16.4.2, Sharp 0.35.5, source-map-js 1.2.2, patched major-compatible brace-expansion versions. Local TypeScript, ESLint, Prettier, 198/198 tests and Next production build PASS. npm audit severity changed from 1 critical + 10 high on the previous lock to 0 critical + 7 high on this branch.

Linux CI lock repaired: Previous run failed before tests on missing yaml@2.9.1. Regenerated package-lock in actual Linux Node 22/npm 10 and verified npm ci dry-run. GitHub Actions run 39160665312 now passed clean npm ci, typecheck, lint, format, all tests, translations, image verification and build. Remaining failure is ONLY the unmodified full npm audit --audit-level=high gate.

Unresolved upstream security: 7 High findings are the same braces@3.0.3 advisory GHSA-vfj7-8cjw-p6xm propagated via Keystatic/Chokidar and Next ESLint/fast-glob/micromatch. No safe published braces fix was found; npm audit fix --force proposes breaking dependency changes. Do not disable audit or claim all vulnerabilities cleared. This PR remains OPEN, not deployed, pending a compatible upstream fix or an explicit separately reviewed risk decision. The live MingleStage MVP and GitHub/Soursea backlinks remain unaffected.