* chore: have renovate hold PRs for 3 days after release

Recent renovate PRs went red because freshly-published versions
weren't fully propagated on the npm registry / CDN. `minimumReleaseAge`
delays PRs until the version is at least three days old, and
`internalChecksFilter: "strict"` suppresses the PR entirely until
that window passes rather than opening it and blocking merge.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: anchor vite to ^8 in root devDependencies

Without a root-level vite, pnpm peer-resolves vitest@4 against the
vite@5.4.21 that vitepress pulls in, which lacks the ./module-runner
subpath vitest needs and breaks lockfile-maintenance refreshes
(see PR #4786). Anchoring vite at ^8 (within vitest 4's declared peer
range of ^6 || ^7 || ^8) keeps the topology stable across regens
while vitepress retains its own scoped vite@5.

Also tightens the coverage `include` glob to *.{ts,js,mjs,cjs} so
vitest 4's uncovered-files pass under vite@8 stops trying to parse
commitlint.schema.json as JavaScript.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Lock file maintenance updates are package-manager-controlled and have
no release timestamp, so the minimumReleaseAge (renovate/stability-days)
status check can never pass. These PRs sit pending forever (e.g. #4786,
#4775) even though all real CI is green and the check is non-required.

Add a packageRule setting minimumReleaseAge: null for the
lockFileMaintenance update type, mirroring Renovate's own
security:minimumReleaseAgeNpm preset ("Do not require Minimum Release
Age for update types that are controlled by the package manager"). The
3-day gate and internalChecksFilter: strict stay in effect for all
regular dependency updates.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>