Restore dependency updates through reviewed pull requests

[woksin]

Problem

Components 4 intentionally replaced direct scheduled package mutation with a permissions-empty failing workflow while the dependency graph and publication boundary were being secured. The committed lockfile and immutable CI now make updates reproducible, but there is no automated PR-producing replacement.

Direction

Restore automation only as reviewed pull requests:

• update manifests and the single root lockfile together;
• never push directly to main;
• never publish, dispatch release workflows, or receive publication credentials;
• group low-risk patches conservatively and isolate renderer-major/package-manager changes;
• run compatibility generation, public types, package graph, adapter boundaries, Storybook, production audit, and release-evidence self-tests before merge;
• expose lockfile, checksum, peer-warning, and exception-metadata changes in the PR.

Acceptance criteria

• Scheduled/manual automation opens a branch and PR with least-privilege permissions.
• Main and publication paths remain unreachable.
• Lockfile installs immutably and checksum changes are reviewable.
• PrimeReact 10/11 remain isolated and bounded.
• Upstream type exceptions fail stale when a dependency update fixes them.
• Failure leaves no direct repository or registry mutation.