chore(security): patch audit findings

[GSTJ]

Summary

Updates two vulnerable transitive packages and fixes the workflow and commit-message checks.

Details

• Forces brace-expansion 5.0.9 and fast-uri 3.1.5, clearing GHSA-rgw5-rvv9-x895 and GHSA-7p8r-x3mc-p8w7 from the workspace.
• Updates the shared workflows to v1.12.3.
  • 4c640f094849d988c7380e1512f87c46a5408515 - the release commit used by every reusable call.
  • contents: read - limits the CI token to reading repository content.
  • pull-requests: write - removed from the release job.
• Installs Husky with the rest of the repository and gives commitlint the message file passed by Husky 9.
• Removes expired pnpm release-age exemptions and the root Expo fields that its config loader ignored.
• Runtime code and generated JS and types are unchanged. The release planner sees a chore-only commit and returns no release. npm remains at 1.2.1.

Testing steps

1. Install dependencies, audit them, and run the tests:

   pnpm install --frozen-lockfile
   pnpm audit --audit-level low
   pnpm test

   The audit should report no known vulnerabilities and the tests should pass.

2. Check the commit hook and release decision:

   git config --get core.hooksPath
   message_file=$(mktemp)
   printf 'not conventional\n' > "$message_file"
   if sh .husky/commit-msg "$message_file"; then exit 1; else echo "invalid message rejected"; fi
   rm "$message_file"
   node tools/release-plan.mjs

   The first command should print a configured hook directory, the sample message should be rejected, and the planner should say there is nothing to release.

3. Build the example for each supported platform:

   pnpm --filter react-native-magic-toast-example exec expo export --platform ios
   pnpm --filter react-native-magic-toast-example exec expo export --platform android
   pnpm --filter react-native-magic-toast-example exec expo export --platform web

   Each export should finish with an exported bundle and no ignored-config warning.

4. Open the pull request's Checks tab and confirm Branch Checkup completes successfully.

[GSTJ]

Local proof from ea25991: the production web export renders and fires its initial toast. The checks image covers the clean Node 24 audit, passing tests, workflow validation, all three production Expo bundles, and release=false.