[AntonNiklasson]

Summary

Add an AST-based production-source and dependency check to lint. Reject network clients/direct requests outside sync, renderer transport outside api.ts, absolute renderer API calls, and imports of sync internals. Electron readiness/port allocation and its updater are explicit exceptions.

Validation

Local stack head 1d1d925 passed:

• pnpm typecheck, pnpm test (171 unit/integration tests)
• pnpm lint (including four boundary checks), pnpm fmt:check
• pnpm test:e2e (five Chromium scenarios)
• pnpm test:desktop (packaged macOS arm64 launch, restart, SQLite and shutdown)

These are local results; GitHub checks are reported separately.

How to review

Start with scripts/check-boundaries.test.mjs. The checker is a regression guard for ordinary imports/calls, not a security sandbox.

Related

Part of #84. Prerequisite: #83.

This PR is part of a stack; review and merge from the bottom upward. Each PR targets the preceding branch.

1. #85: Use the sync package for all desktop GitHub access
2. #86: Add a deterministic GitHub simulator
3. #87: Run an isolated interactive status board
4. #88: Verify renderer polling through the real sync engine
5. #89: Show persisted sync health and stale-data warnings
6. #90: Exercise conflict, review, rate-limit and partial-outage states
7. #91: Guard clients against bypassing the public sync API ← This PR
8. #92: Attach named visual states to browser reports
9. #93: Launch and restart the packaged Electron app in isolation