LeoTM

`.vscode/extensions.json` Lower supply chain risk (VSCodium abuse via malicious extensions)

i.e. Static Hermes https://reactnative.dev/blog/2025/10/08/react-native-0.82#experimental-hermes-v1 Follow-up - https://github.com/endojs/endo/issues/2761 - integrate into Endo Hardened JS CI updstream - deprecate hermes-engine-cli v0.12.0 - update docs upstream https://github.com/endojs/endo/blob/master/docs/lockdown.md?plain=1#L691-L714

Refs - https://metamask.io/en-GB/news/metamask-security-report-june-2025 - https://github.com/endojs/endo/issues/1891 - https://github.com/endojs/endo/issues/2761 - https://github.com/endojs/endo/blob/master/packages/ses/NEWS.md#v1130-2025-06-02 - https://github.com/endojs/endo/blob/master/packages/ses/CHANGELOG.md - https://github.com/LavaMoat/LavaMoat/pull/1438 - https://github.com/MetaMask/metamask-mobile/pull/16341 - https://github.com/HathorNetwork/hathor-wallet-mobile/pull/741

https://lavamoat.github.io/guides/allow-scripts/#mitigating-bin-script-confusion

https://dev.to/naugtur/get-safe-and-remain-productive-with-can-i-ignore-scripts-2ddc

unify: lint + style - [eslint.style](https://eslint.style) - [eslint-stylistic/eslint-stylistic](https://github.com/eslint-stylistic/eslint-stylistic) 96 ESLint rules, max control 1 engine/pipeline