ci: adopt CLDMV @v4 workflows + vitest-runner test setup

.configs/vitest.config.mjs

@@ -0,0 +1,27 @@
+import { defineConfig } from "vitest/config";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+// Anchor the project root to the package directory so include/exclude work no
+// matter what cwd vitest is invoked from.
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+export default defineConfig({
+	root,
+	test: {
+		include: ["tests/**/*.test.mjs"],
+		exclude: ["node_modules"],
+		environment: "node",
+		testTimeout: 30000,
+		// "dot" keeps non-interactive CI logs to one character per test file. The
+		// final "Test Files X passed" / "Tests Y passed" summary is unaffected.
+		reporters: ["dot"],
+		coverage: {
+			provider: "v8",
+			// Single-file library — the only source under test is sizeofvar.js.
+			include: ["sizeofvar.js"],
+			exclude: ["**/*.json", "tests/**", "test/**"],
+			reporter: ["text", "html", "json-summary", "json"]
+		}
+	}
+});

.github/dependabot.yml

@@ -0,0 +1,79 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/automation/dependabot.yml
+# @Date: 2026-05-26 00:00:00 -07:00 (1782460800)
+# @Author: Nate Corcoran <CLDMV>
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/dependabot.yml
+#
+# Dependabot configuration tuned for the v4 staging-branch release flow.
+#
+# How it fits with v4:
+#   - All Dependabot PRs target `next` so they pool with every other
+#     contributor change and batch into the next release.
+#   - `dependabot-auto-merge.yml` (in this same folder) auto-merges
+#     patch/minor bumps into `next` after CI passes — zero-touch pooling.
+#     Delete that workflow if you'd rather review each bump by hand.
+#   - Security updates are detected by `hotfix-redirector.yml`
+#     (release-flow-v4/) by GHSA references in the PR body and auto-promoted
+#     from `next` → `hotfixes` so they ship via the hotfix lane, not the
+#     next-batch release. No special routing needed in this config.
+#
+# Customize per repo:
+#   - Add or remove `package-ecosystem` blocks for your stack (gomod, pip,
+#     bundler, gradle, maven, cargo, docker, etc.).
+#   - Adjust `directory` if your manifests don't live at the repo root.
+#   - Tighten `open-pull-requests-limit` if Dependabot's noise is too much.
+#   - Add `allow` / `ignore` rules for specific packages.
+#   - Add `groups` to bundle related bumps into a single PR.
+
+version: 2
+updates:
+    # GitHub Actions: keep pinned action SHAs / version tags fresh.
+    - package-ecosystem: "github-actions"
+      directory: "/"
+      target-branch: "next"
+      schedule:
+          interval: "weekly"
+      open-pull-requests-limit: 5
+      commit-message:
+          prefix: "deps"
+      # Grouped PRs cut noise: one PR per (security | patch | minor) bundle
+      # per week instead of N separate PRs. Security PRs still get retargeted
+      # to `hotfixes` by hotfix-redirector.yml when GHSA refs appear in the
+      # body — bundling N GHSA fixes into one PR is fine, the redirector
+      # only needs one match to retarget.
+      groups:
+          security:
+              applies-to: security-updates
+              patterns: ["*"]
+          patch:
+              applies-to: version-updates
+              update-types: ["patch"]
+          minor:
+              applies-to: version-updates
+              update-types: ["minor"]
+
+    # NPM: package.json + package-lock.json updates.
+    # Delete this block if your repo isn't a Node project.
+    - package-ecosystem: "npm"
+      directory: "/"
+      target-branch: "next"
+      schedule:
+          interval: "weekly"
+      open-pull-requests-limit: 5
+      commit-message:
+          prefix: "deps"
+      groups:
+          security:
+              applies-to: security-updates
+              patterns: ["*"]
+          patch:
+              applies-to: version-updates
+              update-types: ["patch"]
+          minor:
+              applies-to: version-updates
+              update-types: ["minor"]

.github/workflows/branch-retention.yml

@@ -0,0 +1,38 @@
+#
+# @Project: @cldmv/sizeofvar
+# @Filename: /.github/workflows/branch-retention.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran <CLDMV>
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/branch-retention.yml
+#
+# On PR merge: most branches deleted immediately; release/* keeps last 5,
+# hotfix/* keeps last 3. master/main/badges/gh-pages never touched.
+#
+# v4 flow: feature PRs merge into `next` and hotfix PRs into `hotfixes`
+# (not directly into master). next/hotfixes are in the branches: filter
+# below so this workflow fires on those PR closures too — otherwise
+# feat/* / fix/* / chore/* etc. would pile up on origin indefinitely.
+# (Repos that haven't adopted v4 just won't see those branches; the
+# extra entries in the filter are harmless.)
+name: 🌿 Branch Retention
+
+on:
+    pull_request:
+        types: [closed]
+        branches: [master, main, next, hotfixes]
+
+permissions:
+    contents: write
+    pull-requests: read
+
+jobs:
+    retain:
+        if: github.event.pull_request.merged == true
+        uses: CLDMV/.github/.github/workflows/reusable-branch-retention.yml@v4
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}