docs: nameless package.json pollutes lockfile with worktree dir name

[CybotTM]

Summary

From a cross-session retrospective (2026-06-27): a recurring npm-in-a-worktree gotcha.

When package.json has no name field, npm install stamps the checkout directory name into package-lock.json as the root package name. In the git-worktree convention the checkout dir is branch-named (e.g. a Dependabot worktree like fix-dependabot-npm-uuid/) rather than the repo name, so every npm install rewrites the lockfile's name — producing a spurious diff a reviewer or CI flags. Fix: add an explicit name field to package.json. A plain clone (dir == repo name) masks the issue, which is why it surfaces specifically in worktree workflows.

Changes

• skills/github-project/references/dependency-management.md — new "Nameless package.json Pollutes the Lockfile With the Worktree Dir Name" subsection under Troubleshooting Auto-merge (Problem/Cause/Solution, matching the existing house style). No new file; linked reference already enumerated in SKILL.md.

Notes

• No SKILL.md change — it sits at the ~500-word cap; this is references-only.
• No version bump — plugin.json and SKILL.md are already in sync at 2.15.3 and the parity check only enforces they match each other, not that they change for a docs/references edit.
• Local validation (pre-commit): markdownlint-cli2, check-version-parity, trailing-whitespace, end-of-file-fixer all Passed.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[gemini-code-assist]

Code Review

This pull request adds a new section to the dependency management documentation detailing how a nameless package.json can pollute the package-lock.json file when working within a git worktree. The review feedback suggests minor grammatical and formatting improvements, such as adding the missing preposition "on" and consistently using "git worktree" without a hyphen.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud