ci(nx): enforce synchronized dependency updates (#1343)

* ci(nx): enforce lockstep dependency versions

* ci(deps): group Nx updates explicitly

* docs(nx): document coordinated dependency updates

* fix(nx): validate peer dependency versions

* fix(nx): validate duplicate root declarations

.github/dependabot.yml

@@ -1,7 +1,8 @@
 # Every Dependabot PR triggers the full pipeline (~15 jobs), so version
-# updates are batched: weekly cadence, minor+patch bumps grouped into one PR
-# per ecosystem, majors as individual PRs so CI gates them one by one.
-# Security updates are separate and are not limited by this schedule.
+# updates are batched weekly. Nx minor+patch updates use a dedicated group so
+# official packages move together; other minor+patch updates are grouped per
+# ecosystem, and majors remain individual. Security updates are separate and
+# are not limited by this schedule; CI enforces complete Nx lockstep.
 version: 2
 updates:
     - package-ecosystem: npm
@@ -12,7 +13,24 @@ updates:
           time: '06:00'
       open-pull-requests-limit: 5
       groups:
+          nx-version-updates:
+              applies-to: version-updates
+              patterns:
+                  - nx
+                  - '@nx/*'
+              update-types:
+                  - minor
+                  - patch
+          nx-security-updates:
+              applies-to: security-updates
+              patterns:
+                  - nx
+                  - '@nx/*'
           npm-minor-patch:
+              applies-to: version-updates
+              exclude-patterns:
+                  - nx
+                  - '@nx/*'
               update-types:
                   - minor
                   - patch

.github/workflows/ci.yml

@@ -147,6 +147,9 @@ jobs:
             - name: Install dependencies
               run: pnpm install --frozen-lockfile
 
+            - name: Validate Nx dependency version policy
+              run: pnpm run deps:nx:validate
+
             - name: Typecheck web and Electron entry points
               run: pnpm run typecheck:ci