Unbreak the release pipeline: plugin-react must accept vite 8

[vivekchand]

No release can publish right now. release-on-merge.yml runs npm ci in frontend/, and it fails ERESOLVE. The [RELEASE] merge for #5055 produced no PyPI upload at all, and neither will any other until this lands.

npm error While resolving: @vitejs/plugin-react@4.7.0
npm error Found: vite@8.2.2
npm error   dev vite@"^8.2.2" from the root project
npm error peer vite@"^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"
            from @vitejs/plugin-react@4.7.0

Cause

#5376 (dependabot, "bump esbuild and vite") took vite to ^8.2.2 and left @vitejs/plugin-react at ^4.7.0, which peers only up to ^7.

They are separate dependabot PRs, so nothing evaluated them together. And the break is invisible on every ordinary PR — npm ci in frontend/ runs only on the release path, so the first symptom is a [RELEASE] that merges cleanly and silently ships nothing.

Fix

@vitejs/plugin-react@6.1.0 peers vite: ^8.0.0; its three other peers are marked optional. That bump is the whole fix.

Why not just merge dependabot #5257, which proposes the same bump: it touches package.json only. npm ci requires package.json and package-lock.json to agree, so merging it alone swaps one npm ci failure for another. Both files are updated here.

Verified by running the release step's own commands

before (origin/main):  npm ci        -> exit 1, ERESOLVE      [reproduced locally]
after:                 npm ci        -> exit 0, 86 packages
                       npm run build -> exit 0, bundle emitted in 509ms

A note on how that was checked: my first attempt read exit=$? after a pipe, so it reported 0 while npm had actually failed and installed nothing. The numbers above come from capturing npm's own exit code directly.

Scope

Deliberately minimal — package.json and package-lock.json only. The build rewrote clawmetry/static/v2/dist with fresh content hashes; that churn is reverted, because the release workflow rebuilds the bundle itself ("Build v2 React bundle (fresh)"), so the committed dist is not what ships and a smaller diff is worth more on a pipeline-unblocking change.

No-PRD: restores a broken release pipeline; no product surface changes.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xb6A5G74JiMe3zHFs1JZEP

[8090-software-factory]

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.