[yordis]

• Keep the toolchain on the layout vp validate expects, so running it no longer leaves a dirty tree.
• Pin the setup-vp action so CI cannot pick up a new Vite+ release before we have tested it.

[cursor]

PR Summary

Low Risk
Toolchain, lockfile, and CI action pin only; no product runtime or auth changes.

Overview
Aligns the monorepo with the Vite+ layout that vp validate expects, so validation no longer rewrites manifests or leaves a dirty tree.

Vitest is added as a catalog: devDependency next to vite-plus across apps, packages, infra, evals, and scripts; the workspace catalog pins vitest and @vitest/browser-playwright at 5.0.5, with pnpm vite@* / vitest@* overrides and peer rules. knip ignores vitest because tests still resolve it via vite-plus/test. .vitest/ is gitignored for new cache output.

CI Setup Vite+ steps are pinned from @v1 to voidzero-dev/setup-vp@v1.21.2 in mobile EAS fork preview and relay preview deploy/cleanup workflows so CI cannot drift to an untested action release.

^{Reviewed by Cursor Bugbot for commit cf6a87a. Bugbot is set up for automated code reviews on this repo. Configure here.}