fix(template): refresh Next.js nanoid lock resolution

docs/dependency-policy.md

@@ -27,3 +27,13 @@ After a generated repository adds `package.json`, extend `.github/dependabot.yml
 Run the project's smallest relevant verification before merging dependency
 updates. For Node projects, that usually means lint, tests, typecheck, and build
 when those scripts exist.
+
+## Refreshing the Next.js template lockfile
+
+The `next-app` template keeps its generated npm lockfile in
+`templates/next-app/package-lock.json`. Refresh a transitive package with
+`npm update <package> --package-lock-only --ignore-scripts` inside a freshly
+generated `next-app`, then copy the resulting lockfile back into the template.
+Run `pnpm test` to check the repository's deterministic lockfile invariants and
+`pnpm run release:check` to exercise the generated app's clean install, lint,
+production build, audit, and validation gates.

scripts/check-template-registry.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import { listTemplates, TEMPLATE_KEYS, TEMPLATE_REGISTRY } from '../dist/templates.js';
 
 const expectedKeys = ['next-app', 'oss-cli', 'python-api'];
@@ -36,4 +37,20 @@ if (JSON.stringify(parsed.templates) !== JSON.stringify(templates)) {
   throw new Error('CLI templates output does not match typed registry');
 }
 
+const nextAppLock = JSON.parse(readFileSync(new URL('../templates/next-app/package-lock.json', import.meta.url), 'utf8'));
+const nanoid = nextAppLock.packages?.['node_modules/nanoid'];
+if (!nanoid?.version) {
+  throw new Error('Next.js template lockfile is missing nanoid');
+}
+
+const minimumNanoidVersion = [3, 3, 17];
+const nanoidVersion = nanoid.version.split('.').map(Number);
+const firstDifference = nanoidVersion.findIndex((part, index) => part !== minimumNanoidVersion[index]);
+const nanoidIsSupported = nanoidVersion.length === 3
+  && nanoidVersion.every(Number.isInteger)
+  && (firstDifference === -1 || nanoidVersion[firstDifference] > minimumNanoidVersion[firstDifference]);
+if (!nanoidIsSupported) {
+  throw new Error(`Next.js template requires nanoid >=3.3.17, got ${nanoid.version}`);
+}
+
 console.log('template registry check passed');