[pull] main from withastro:main - #675

@astrojs/cloudflare@14.2.0 imports beginContentEntryCollection,
beginImageCollection, endContentEntryCollection, and endImageCollection
from astro/app, which were added in astro@7.2.0. The previous peer
dependency range of ^7.0.0 allowed resolution of astro@7.1.x, causing a
MISSING_EXPORT build failure.

Fixes #17622

…is enabled (#17628)

When both `security.csp` and `experimental.clientPrerender` are enabled,
the prefetch module's dynamic per-URL `<script type="speculationrules">`
injection causes CSP violations because the scripts' hashes are not in
the CSP policy.

Switch to a static `"source": "document"` approach with CSS selector
matching (`a[data-astro-prefetch]`) that produces a deterministic JSON
payload. The hash is computed at build time and included in the CSP
`script-src` directive. The client-side prefetch code detects static
rules and skips dynamic injection.

Fixes #17599

* fix(content): validate references after sync to catch invalid entry IDs

Adds post-sync reference validation to the content layer. After all
loaders complete, walks entry data to find reference objects and checks
that referenced entries exist in the store. Logs an error when a
reference points to a non-existent entry.

This restores validation that was lost during the Zod 4 upgrade
(PR #14956), which removed the inline store check from createReference().

Fixes #17322

* Add changeset

---------

Co-authored-by: Matthew Phillips <matthew@matthewphillips.info>

…onents (#17618)

* fix(language-server): restore auto-import code actions for Astro components

* fix(language-server): use RegExp#exec in Astro import rewrite

* fix(language-server): type the diagnostic report in the code action test

* ci(language-tools): pin vscode test to 1.131.0 for macOS arm64

* ci(language-tools): upgrade @vscode/test-electron to fix macOS launch

VS Code 1.110+ removed the Contents/MacOS/Electron compatibility symlink,
so @vscode/test-electron 2.5.2 spawns a nonexistent launcher and fails with
ENOENT on macOS. 3.x resolves the real binary (Code) under Contents/MacOS.
Reverts the 1.131 version pin, which did not help since any 1.110+ build fails.

---------

Co-authored-by: Matthew Phillips <matthew@matthewphillips.info>