fix(deps,app-cli): advisory bound, SDK 0.85.5, Renovate androidx pin, app-cli timeouts

[willgriffin]

{"schema":"hv-agent-run:v1","runtime":"claude","session":"8a94e288-0358-403f-a3a6-8e81a80e6c5d","issue":"2204","head_sha":"b2e59d27a79efcd0896198ccfdbf412dfe1fb671","policy_revision":"1.0.0","status":"complete"}

Why one PR

Four patch-class changes, four files, one validation pass. Supersedes #2244, #2235, #2205 and
#2233, all closed in favour of this branch; every commit is cherry-picked verbatim with its
original author.

Two of them make this more than a convenience: #2205 and #2233 both rewrite
pnpm-workspace.yaml and pnpm-lock.yaml. Merged separately they conflict, and whichever
landed second would need a rebase and lockfile regeneration anyway. Bundling resolves that once.

commit	was	closes
e1a57d6	#2244	#2243
3bd41ec	#2235	#2234
a407707	#2205	#2204
3473f25	#2233	— (release-bot SDK sync)

What lands

• packages/app-cli/vitest.config.ts — explicit testTimeout/hookTimeout at 30000.
  bridge.test.ts spawns tsx and completes an MCP handshake on what was vitest's 5 s default;
  it passed on the affected lane and timed out in the merge queue, ejecting perf(ci): unblock the validation lane — occupancy, hosted light jobs, fixture hookTimeout #2242.
• renovate.json — allowedVersions rules holding androidx.core below 1.18 and
  androidx.lifecycle below 2.11, the constraint libs.versions.toml records only in comments
  and Renovate therefore overrode every week, failing :sample:checkDebugAarMetadata.
• pnpm-workspace.yaml — brace-expansion override regains its lower bound
  (>=4.0.0 <5.0.9, matching GHSA-rgw5-rvv9-x895) so it no longer reaches into unaffected
  majors; SDK pins move ^0.84.0 → ^0.85.5 with the matching minimumReleaseAgeExclude entries.
• pnpm-lock.yaml — regenerated once over both changes.

Validation

• pnpm install --lockfile-only after both workspace edits produced zero drift from the
  cherry-picked lockfile, confirming the two commits were already mutually consistent
• Supply-chain policy check passed (1587 entries)
• Lockfile diff is confined to the SDK version moves and the mirrored override key; no package
  resolution moves
• No source code is touched — the changes are two config files, one test-budget config, and the
  lockfile

Closes #2243
Closes #2234
Closes #2204

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Pull request overview

This PR bundles several patch-class maintenance updates to keep dependency automation, security overrides, and CI test execution stable across the SMRT monorepo (Renovate constraints for Android deps, pnpm override bounds + SDK pin sync, and explicit Vitest timeouts for app-cli).

Changes:

• Add Renovate allowedVersions rules to prevent weekly AndroidX bumps that exceed the repo’s current compileSdk 36 constraint.
• Update centralized @happyvertical/* SDK pins to ^0.85.5 (including corresponding minimumReleaseAgeExclude entries) and regenerate the lockfile once.
• Set explicit testTimeout and hookTimeout (30s) for packages/app-cli to prevent merge-queue timeouts in process-spawning tests.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
renovate.json	Adds Gradle package rules constraining AndroidX versions to remain compatible with compileSdk 36.
pnpm-workspace.yaml	Updates SDK override/catalog pins to ^0.85.5, narrows the brace-expansion override selector to the advisory’s affected range, and extends minimumReleaseAgeExclude.
pnpm-lock.yaml	Regenerates the lockfile to reflect the updated workspace overrides and SDK version pins.
packages/app-cli/vitest.config.ts	Sets explicit Vitest testTimeout/hookTimeout to avoid merge-queue timeouts for the MCP/tsx spawning test.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file