Post-squash-merge verification: catch commits/security pins dropped by squash-merge

[alamb-hex]

Problem

Squash-merging a PR has twice silently dropped commits from main:

• ci: add GitHub Actions pipeline + refresh README badges #104 — the late "Credits" commit (5fd00ac, pushed near merge time) was missing from the squash; re-applied via cherry-pick (2c225ad).
• CVE Lite: Apply → Commit → Push parity + remediation audit trail (#107) #108 — the qs security override (f3a5789, pnpm.overrides:{qs:6.15.2}) was dropped, regressing main to a vulnerable qs@6.15.1 (CVE-2026-8723 / GHSA-q8mj-m7cp-5q26). Caught later by a routine scan; re-fixed in ebbb582.

A dropped security pin is the worst case: CI (--frozen-lockfile) and fresh clones silently install the vulnerable version, and nothing flags it until the next scan.

Proposal

• A lightweight post-merge check (CI job or local helper): after a squash-merge, diff main against the merged branch tip and report any file/override/lockfile delta that didn't make it in — especially package.json overrides and pnpm-lock.yaml version pins.
• Optionally: a guard that fails CI if the committed lockfile contains a package version that a declared overrides entry says should be pinned higher (covers the dropped-pin case directly).

References

Related: the qs regression (ebbb582), #109 (the apply path that masked it).