chore(upstream): sync marcode through fff33f9e

.agents/skills/test-t3-mobile/SKILL.md

@@ -80,7 +80,6 @@ Run Metro from `apps/mobile`.
    APP_VARIANT=development vp exec expo start \
      --dev-client \
      --scheme t3code-dev \
-     --clear \
      --lan \
      --port <metro-port>
    ```
@@ -179,6 +178,7 @@ Keep local verification focused. Do not turn this workflow into a full repositor
 ## Troubleshoot predictable failures
 
 - **Old UI or an old error appears:** verify Metro's worktree, variant, URL, and port before diagnosing the app.
+- **Metro serves stale or invalid transforms after those checks:** stop the owned Metro process and run `vp run dev:client:reset` once on the standard port. For a custom port, add `--clear` to the complete explicit `expo start` command above.
 - **The environment remains empty:** verify the platform-specific HTTP origin, use a fresh token, and confirm project seeding used the identical base directory.
 - **A second client cannot pair:** pairing tokens are single-use; issue another token.
 - **The pairing form opens but does not connect:** confirm the deep link uses the existing `connections/new` route, includes `autoConnect=1`, and carries a freshly minted encoded `pairingUrl`.

.coderabbit.yaml

@@ -0,0 +1,4 @@
+reviews:
+  review_status: false
+  auto_review:
+    enabled: false

.github/VOUCHED.td

@@ -9,6 +9,8 @@
 #   -github:username reason for denouncement
 #
 # Keep entries sorted alphabetically.
+github:0x4bs3nt
+github:Adamulek123
 github:adityavardhansharma
 github:arhxam
 github:bil0000
@@ -26,6 +28,7 @@ github:github-actions[bot]
 github:gsimone
 github:GuilhermeVieiraDev
 github:hwanseoc
+github:ipanasenko
 github:jakeleventhal
 github:jamesx0416
 github:jappyjan
@@ -37,7 +40,9 @@ github:lnieuwenhuis
 github:Lucenx9
 github:mackinleysmith
 github:maria-rcks
+github:maxwellyoung
 github:mwolson
+github:nateEc
 github:nmggithub
 github:Noojuno
 github:notkainoa
@@ -48,6 +53,7 @@ github:PollyGlot
 github:RakshithBhat03
 github:realAhmedRoach
 github:Rishet11
+github:ryanrhughes
 github:saphid
 github:sethwebster
 github:shiroyasha9
@@ -56,6 +62,7 @@ github:StiensWout
 github:SunkenInTime
 github:tarik02
 github:tris203
+github:tsouth89
 github:UtkarshUsername
 github:Yash-Singh1
 github:yashranaway

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -52,10 +55,7 @@ jobs:
         run: vp run build:desktop
 
       - name: Verify preload bundle output
-        run: |
-          test -f apps/desktop/dist-electron/preload.cjs
-          grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs
-          grep -n "__clerk_internal_electron_passkeys" apps/desktop/dist-electron/preload.cjs
+        run: node apps/desktop/scripts/verify-preload-bundle.mjs
 
   # Everything except `t3` (apps/server). `--parallel` drops the package
   # dependency ordering that `vp run` applies by default: these `test` tasks