feat(renovate): gate Expo SDK updates behind the dependency dashboard

expo, react, react-native and Expo-managed modules (expo-*, @expo/*) are
pinned by the Expo SDK and must be upgraded together via `expo install
--fix`. Individual Renovate update PRs for them risk broken builds, so
group them as "Expo SDK" and require manual dashboard approval.

.github/renovate.json

@@ -44,22 +44,42 @@
       ]
     }
   },
-  "lockFileMaintenance": {
+  "vulnerabilityAlerts": {
-    "vulnerabilityAlerts": {
+    "enabled": true,
-      "enabled": true,
+    "addLabels": ["security", "vulnerability"],
-      "addLabels": ["security", "vulnerability"],
+    "assigneesFromCodeOwners": true,
-      "assigneesFromCodeOwners": true,
+    "commitMessageSuffix": " [SECURITY]"
-      "commitMessageSuffix": " [SECURITY]"
+  },
+  "packageRules": [
+    {
+      "description": "Expo SDK coherence: expo, react, react-native and Expo-managed modules are pinned by the Expo SDK and must move together (via `expo install --fix`), so do not raise individual update PRs — group them and require manual approval from the Dependency Dashboard",
+      "matchPackageNames": [
+        "expo",
+        "react",
+        "react-dom",
+        "react-native",
+        "react-native-web",
+        "expo-*",
+        "@expo/*"
+      ],
+      "groupName": "Expo SDK",
+      "dependencyDashboardApproval": true
     },
-    "packageRules": [
+    {
-      {
+      "description": "Group minor and patch GitHub Action updates into a single PR",
-        "description": "Group minor and patch GitHub Action updates into a single PR",
+      "matchManagers": ["github-actions"],
-        "matchManagers": ["github-actions"],
+      "groupName": "CI dependencies",
-        "groupName": "CI dependencies",
+      "groupSlug": "ci-deps",
-        "groupSlug": "ci-deps",
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
-        "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
+      "automerge": true
-        "automerge": true
+    },
-      }
+    {
-    ]
+      "description": "androidx and other Google-hosted Maven packages resolve from Google's Maven repository (not Maven Central)",
-  }
+      "matchDatasources": ["maven"],
+      "registryUrls": [
+        "https://dl.google.com/dl/android/maven2/",
+        "https://repo.maven.apache.org/maven2/"
+      ]
+    }
+  ]
 }