Laravel Starter Kit Upgrade

• Users bootstrap from laravel/vue-starter-kit, react-starter-kit, svelte-starter-kit, or livewire-starter-kit, then customize. They own the code.
• We pick specific features from upstream (e.g. "toast notifications", "2FA autofocus fix"), not "version upgrades."
• The user's git history is unrelated to the kit's. There is no common ancestor. We compare user-now vs upstream-now, byte by byte.
• We never auto-merge a customized file. Customizations are surfaced; the user decides.
• Behavior preservation is the contract: the user's currently-passing tests/typecheck/build must still pass after.

Safety contract: non-negotiable

Read these to the user before any side effects, and live by them throughout:

1. Working tree must be clean. If git status --porcelain is non-empty, refuse and tell the user to commit or stash. Do not "stash for them."
2. All work happens on a dedicated branch (starter-kit-upgrade/<short-id>). The user's current branch is never modified.
3. Each applied feature is its own commit. That is how revertability works.
4. Never auto-resolve conflicts. A change touching customized code is surfaced; default action is to skip the file.
5. Never silently overwrite manifests or lockfiles (composer.json, package.json, *-lock.*). Show diffs; let the user decide.
6. Verify behavior preservation. Re-run the user's tests/typecheck/build after applying. A previously-passing check that now fails is a regression. Stop, surface, recommend revert.
7. Detect from unambiguous signals; ask when ambiguous. Concrete evidence (e.g. config/fortify.php exists) is fine. Picking a likely answer when signals are mixed or absent is not.