chore: integrate verified dependencies and patch devalue advisory

[CodeinScrubs]

Summary

Consolidate dependency proposals #152, #153, #154, and #156 onto current main and verify the actual combined tree. Preserve compatible updates and resolve shared React peer/lockfile conflicts.

• Update SHA-pinned setup-java and pnpm/action-setup, development tools, React/types, and Markdown-It.
• Pin devalue 5.9.2 (registry-integrity verified) for GHSA-9rgm-9g3h-6x36 / Dependabot alert release(android): publish Maven Central 0.1.1 #17 in the Svelte development tree.
• Add a weekly/manual dependency audit with read-only repository permissions and installation scripts disabled. Keep runtime/peer compatibility ranges and security gates intact.
• Document review, publication boundary, and evidence-based Android deferrals. chore(deps): bump org.jetbrains.kotlin.plugin.compose from 2.4.10 to 2.4.20 in /android #155's Android jobs passed; its documentation and CodeQL compatibility failed.
• Strengthen the existing native clipboard test's focus/selection/action preconditions and retain Android UI reports plus failure diagnostics before emulator shutdown. No production rendering code is changed.

Verified for dependency revision e37257c

• Frozen pnpm 10.27.0 install and dependency audit passed; no known vulnerabilities reported.
• pnpm run check: 600 tests; Unicode/shared corpus; types/lint; builds; Action checks passed.
• Final isolated Playwright 1.63 run: 48 tests passed on Windows Chromium/Firefox/WebKit. An earlier overlapping build invalidated one trial; the final run had no competing build.
• Release check: 12 tarballs and package examples, 4 compiled guides, runtime and CLI consumers passed.
• Packed TypeScript consumers: all 12 passed.
• Markdown-It 13/14/15: 932 corpus cases and 9 structural cases per version passed.
• CycloneDX 1.7 SBOM: 531 components / 545 relationships validated.
• actionlint 1.7.12 and docs checks passed.
• Independent dependency review found no actionable regression and verified all 57 changed registry integrity entries.

Native test investigation

The first combined hosted revision passed 24/25 checks. API 35's exact-source clipboard test timed out twice. Local API 36.1 diagnostics showed clipboard focus denial, but that emulator also had system ANRs and exhausted internal storage; those local results do not establish the hosted root cause.

On revision 46a7eb0, the API 35 job passed. The retained report proves all 4
Views and all 5 Compose tests executed with 0 failures, errors, or skips,
including the exact-source clipboard case. The follow-up retains actual Android
clipboard behavior and exact source comparison, including the author's RLM; no
mock clipboard or skipped assertion is introduced. The stronger preconditions
and retained diagnostics address the flaky test harness without changing
production rendering code. One green hosted run is evidence for this revision,
not a general guarantee that Android infrastructure can never flake.

No package publication is performed by this PR. The workspace override does not update consumers' independently managed Svelte dependency trees. See docs/DEPENDENCY_REVIEW_2026_09_19.md for limitations and deferred toolchain versions.