distill: 48 cross-project best-practices from 2026-07 reflection sweep

Promotions from reflecting 21 projects' session logs (incl. agent-runtimes
122-log drain). Adds coverage across networking (eBPF VIP/VPN SNAT/VLAN
bridge/forward-auth preflight/ingress TLS), kubernetes (CSI hotplug/PodSecurity
debug/self-managed GitOps/runtime annotations), CI (dispatch tokens/runner
death/base image), git (CI-rebase/shallow reset/PR governance), python (async
session pool/httpx redirects/logging), TDD (AsyncMock/xfail lifecycle),
api-integration (SDK parse/token-scope 404/schema probing), plus docker,
scripting, debugging, security-architecture, secrets, react, octopus.

State: .distill-state.json refreshed with current HEADs + 5 newly-tracked projects.

react-vite-dashboard.md

@@ -487,3 +487,7 @@ Gate on `application/problem+json` content type. Create an `ApiProblemError` cla
 ### Token injection
 
 Validate token expiry before making API calls (proactive), not in a 401 response interceptor (reactive). Use the OIDC client's `getAccessTokenSilently()`.
+
+### Run the Real Build (`tsc -b`), Not Just `tsc --noEmit`, Before Pushing
+
+`tsc --noEmit` (what many `typecheck` scripts run) does NOT check test files or apply project-reference settings. `tsc -b` / `vite build` resolves project references and applies `noUnusedLocals` across ALL files including tests — so CI's `npm run build` fails on `TS6133 'X' is declared but never read` in a test file that `typecheck` passed clean. Make the pre-push hook run the actual build command CI runs, not the lighter check. Related strict-mode friction with `noUncheckedIndexedAccess: true` (recommended in §14): every `arr[i]` is `T | undefined` — guard the access or use a justified non-null assertion.