Staleness Audit

Audits the versions a repo pins its toolchain to — the runtime and language versions in dotfiles and manifests — and reports which have fallen behind upstream. Dependabot bumps library dependencies inside a manifest; this audit covers the toolchain pins Dependabot leaves alone (.nvmrc, engines, language-version files).

The spine is scan → classify → validate → apply → render.

Scan — find the pins, don't guess them

A pin is any place the repo declares the version of a tool it builds or runs on. The files below are the illustrative v1 surface — the common places that concept lands across ecosystems — not a frozen catalogue; match the repo's real conventions over this list (a monorepo may pin per-package, a shop may have its own dotfile). Read each, extract the pinned string verbatim, and record (target, file, current) — what is pinned, where, and to what. Scan only; resolving "latest" is the validate station (it stays blank here).