fix(deps): shell-quote 1.12.0 — critical GHSA-pqg4-j6r4-53mv

CHANGELOG.md

@@ -23,6 +23,7 @@ the archive; if it broke production, it belongs in `docs/incidents/`. See
 
 ## [Unreleased]
 
+- **CI** — shell-quote 1.10.0 → 1.12.0 (critical GHSA-pqg4-j6r4-53mv; dev-only, under react-native's react-devtools-core), lockfile-only — deps
 - **Reader** — highlights on the phone now paint on their words anywhere in a chapter; since April they were drawn `scrollY` px above (off screen) below the first screen, because the overlay svg moved with the page and was also shifted by the scroll — mobile
 - **Reader** — a font change at open, during the restore, no longer leaves a window where back or backgrounding saves the chapter top: once a stale restore ack arrives, position reports stop opening the write gate, and only the re-ask's ack or the 4 s deadline opens it; a truly lost ack still opens by position — mobile
 - **Reader (R4)** — a rebuild or font change during the open restore keeps the saved place (non-default typography no longer reopens at the top and saves 0); typography changed before the page loads is applied, also after "Read as text"; a PDF reopens on the device page inside the chapter, not the chapter start; the foreground newer-position check runs after a background renderer kill; restore acks carry the landing position, so a tiny restore is not booked as reading; reflow/rebuild acks never reset the "has the reader moved" baseline — mobile · [ADR-019](docs/01-architecture/adr/ADR-019-reader-position-rules.md) · [details](docs/changelog-archive/2026-H2.md#2026-10-06-reader-r4-and-adr-019)