Dependency management

Keeps every package of an Expo app on a written, verified set: the right version and specifier, in the right place, old enough, not deprecated, reviewed, allowed to ship, and installed once. The facts live in the app's contracts/dependency-policy.json; this skill seeds it, plans every change, and proves the repo against it.

Rules that must hold