Merge remote-tracking branch 'origin/master' into perf/zoneless-flip

# Conflicts:
#	apps/web/src/app/app.config.ts
#	tools/performance/journey-baselines.json

.github/dependabot.yml

@@ -1,10 +1,11 @@
 # Every Dependabot PR triggers the full pipeline (~15 jobs), so version
 # updates are batched weekly. Nx minor+patch updates use a dedicated group so
 # official packages move together; Nx majors are manual coordinated migrations.
-# Native packaging, parser, and version-locked playback dependencies stay in
-# standalone PRs; other minor+patch updates are grouped per ecosystem. Security
-# updates are separate and are not limited by this schedule; CI enforces complete
-# Nx lockstep.
+# Electron majors are held while Linux armv7l packages ship: Electron 44
+# dropped the linux-armv7l binary. Native packaging, parser, and
+# version-locked playback dependencies stay in standalone PRs; other
+# minor+patch updates are grouped per ecosystem. Security updates are separate
+# and are not limited by this schedule; CI enforces complete Nx lockstep.
 version: 2
 updates:
     - package-ecosystem: npm
@@ -21,6 +22,9 @@ updates:
           - dependency-name: '@nx/*'
             update-types:
                 - version-update:semver-major
+          - dependency-name: electron
+            update-types:
+                - version-update:semver-major
       groups:
           nx-version-updates:
               applies-to: version-updates

.github/workflows/ci.yml

@@ -433,6 +433,12 @@ jobs:
             - name: Validate icon-only button names
               run: pnpm run a11y:icon-buttons:validate
 
+            # Form-field defaults are provided per lazy component: the root
+            # token import would load Material form-field and @angular/forms
+            # on startup (tools/nx/check-form-field-defaults.mjs).
+            - name: Validate form-field defaults
+              run: pnpm run ui:form-field-defaults:validate
+
             # Nx rejects a non-parallel task with continuous dependencies, and
             # the Playwright plugin infers serve dependencies only when CI is
             # unset, so this checks both the local and the CI inference.