Stacked features 7: dependency check + extra debounce search input

[AmagiDDmxh]

Stack position

Part 7 of 7. Depends on #417 and completes the stack.

Why

Future dependency upgrades need smaller risk boundaries, and session-local find still reparsed every loaded Markdown message on each keystroke in long sessions.

What changed

Dependency maintenance

• Added weekly Dependabot updates at the pnpm workspace root.
• Grouped patch/minor updates into four explicit lanes: tooling, Electron/native, ACP, and renderer/framework.
• Excluded every high-risk runtime family from the broad tooling group.
• Left major and security updates ungrouped so Electron, ACP, React/Vite, Shiki, Void, and i18next remain independently reviewable.
• Did not perform the Electron 34-to-43 upgrade, unprofiled module splitting, or speculative React memoization.

Session-local find

• Kept the controlled find input synchronous.
• Added a 120 ms trailing debounce before the expensive Markdown-to-visible-text projection.
• Cleared stale highlights/counts while a new query is pending.
• Disabled previous/next navigation until the debounced result is current.

Verification

• Dependabot YAML parsed successfully and its four groups passed a semantic overlap check.
• Every high-risk pattern owned by a narrow group is excluded from the tooling catch-all.
• pnpm install --frozen-lockfile, 9-package typecheck, type-aware lint, and all unit tests passed.
• App unit tests after the debounce change: 488/488.
• Focused Electron E2E for search and session detail: 22/22, including rendered-Markdown matching, keyboard navigation, and a 1,500-message deep-find fixture.
• Complete serial Electron E2E: 166 passed, 2 retry-passed flaky tests, and 1 fixture-dependent skip.
• CLI build, deep strict macOS codesign verification, and sp status passed after the final Node ABI restore.

Review follow-up (maintainer)

The debounce originally hid all find state for its 120 ms window, which made Enter a silent no-op, flashed highlights on every pause, and could yank focus back from the message list. The follow-up commit keeps the previous query's matches visible (dimmed) and navigable until the new projection lands — only "No matches" waits for the settle — and scopes the find bar's focus reclaim to its own controls. Two e2e tests pin the semantics: a MutationObserver asserts the status text never blanks across a retype (immune to debounce timing), and a focus test covers both reclaim-after-button and stay-in-list paths.

Review notes

The debounce is deliberately scoped to the current session's in-memory find. It does not change the cross-session SQLite/FTS search implemented in #416.

[AmagiDDmxh]

CI note: run 29348126384 passed the Ubuntu unit job and Ubuntu E2E. On macOS, 165 of 166 E2E tests passed. The sole failure was the existing startup-no-beachball cold-launch threshold: p99 event-loop lag was 643.3 ms and 610.8 ms on its retry, against the 600 ms limit.

This test does not exercise the session-find debounce changed here. I deliberately did not relax the threshold. GitHub does not allow contributors to rerun the failed job (Must have admin rights to Repository), so a maintainer rerun would be the appropriate confirmation.

[graydawnc]

Thanks for this whole series — seven PRs from typecheck baseline to package size, each one moving the needle on developer experience. The typecheck gate, the native-ABI split, and the search rework are things we'll feel every day. Great work, and looking forward to your next contribution.