ci: harden React dependency updates

[userfypp]

Summary

• Keep automatic React ecosystem version updates limited to patches, while ignoring normal minor and major Dependabot version updates without blocking security updates.
• Add a lockfile-based React stack validation to the required verify job so partial or incompatible React upgrades cannot reach main.

Validation

• Validated the current React stack and aligned React 19.3 fixtures.
• Verified mixed patch versions for React Konva and React types remain valid.
• Verified mismatched React/React DOM, React Konva, React types, missing dependencies, invalid versions, and malformed lockfile structures fail.
• npm run lint
• npm test — 1156 tests passed
• npm run build
• YAML parsing
• Prettier check
• git diff --check