Our standard workflow for federated changes involves adding dependency overrides with a warning comment via repo tooling; we should have something in CI check that things don't actually land with that. We probably want to put it into federated-safety-check rather than pubspec-check even though the latter would seem to be the natural place for it, since we don't want to have a bunch of different CI failures showing up on the combo PRs, as that makes finding actual problems in the PR harder.