chore(deps): pin dependencies - #800

_{P1 Badge} Align React DOM with React in the Rspress lock entries

Every @rspress/core instance now resolves React 19.2.8 together with react-dom 19.2.7, whereas the previous lockfile kept both at 19.2.7. React 19 renderers enforce an exact core/renderer version match, so loading React DOM during the Rspress build aborts with the incompatible-version error and breaks the required binpm, nodeup, and public documentation test/build jobs. Regenerate the lockfile with matching React and React DOM patch versions.

AGENTS.md reference: apps/AGENTS.md:L80-L82

Useful? React with 👍 / 👎.

_{P1 Badge} Update the DevHud validator for pinned action refs

Pinning these action references causes pnpm --filter devhud test to fail because assertMobileCi in apps/devhud/scripts/mobile-policy.mjs:119-121 still requires the literal strings dorny/paths-filter@v4 and pnpm/action-setup@v5. This is immediately reproducible with node apps/devhud/scripts/mobile-policy.test.mjs; moreover, the workflow includes .github/workflows/CI.yml in the DevHud path filters, so this commit activates the desktop matrix jobs at .github/workflows/CI.yml:829-833, where each runs the failing test before packaging. Update the validator alongside the pinned workflow references.

Useful? React with 👍 / 👎.

_{P1 Badge} Update private-workflow assertions for pinned actions

Pinning download-syft here and setup-java in the mobile job leaves scripts/release/devhud-private-workflow.test.mjs matching the old tag-based strings. The plan job runs that suite before producing either a plan-only result or allowing signed packaging, and node --test scripts/release/*.test.mjs now fails two assertions (download-syft@v0.21.0 count and setup-java@v5 presence), so every manual invocation stops in validation. Update these workflow assertions to recognize the pinned references.

AGENTS.md reference: AGENTS.md:L133-L133

Useful? React with 👍 / 👎.

_{P2 Badge} Update the Ubuntu test delimiter for the pinned action

When upload-artifact is pinned here, both Ubuntu-specific slices in scripts/release/devhud-private-workflow.test.mjs:13,60 still search for actions/upload-artifact@v7. That delimiter now returns -1, so slice() extends almost to the end of the workflow instead of stopping at the desktop job; the lifecycle assertions can therefore be satisfied by commands moved into later jobs and no longer enforce their intended scope. Match the pinned reference or use a stable step/job boundary.

Useful? React with 👍 / 👎.

_{P1 Badge} Add an explicit stable toolchain input

When either signed desktop matrix or the mirrored mobile matrix runs, pinning this action by SHA while omitting with.toolchain makes the action treat the SHA as the requested Rust toolchain and pass it to rustup, so toolchain setup fails before packaging. The upstream input contract states that toolchain defaults to the action version specifier; keep the immutable action ref but explicitly set toolchain: stable at both this step and the copy near line 412.

Useful? React with 👍 / 👎.

_{P1 Badge} Update the Docker contract assertion for the pinned base

When either the devhud-api-self or devhud-release-contracts CI job runs, scripts/release/devhud-private-workflow.test.mjs:31 still requires the exact unpinned text node:24-bookworm-slim AS administrator-assets; this digest-qualified FROM line makes node --test scripts/release/*.test.mjs fail before packaging even though the Docker stage still generates the administrator bundle. Update the assertion to accept and validate the required digest-pinned form.

AGENTS.md reference: servers/AGENTS.md:L15-L16

Useful? React with 👍 / 👎.