feat(rn): Capgo React Native updater + CLI with file-level delta

.github/workflows/tests.yml

@@ -999,8 +999,8 @@ jobs:
     permissions:
       contents: read
     concurrency:
-      # Isolate by event_name so push + pull_request on the same branch do not cancel pending jobs.
-      group: capgo-local-services-playwright-${{ github.event_name }}-${{ github.repository }}-${{ matrix.shard }}-${{ github.sha }}
+      # Isolate by event, PR number (or run_id for non-PR events), and strategy.job-index.
+      group: capgo-local-services-playwright-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}-${{ strategy.job-index }}
       cancel-in-progress: false
     strategy:
       fail-fast: false
@@ -1232,8 +1232,8 @@ jobs:
     if: needs.changes.outputs.run_cli == 'true'
     name: CLI POSIX paths (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
-    # windows-2022 often needs >5m for bun install + CLI zip under shared runners.
-    timeout-minutes: 10
+    # windows-2022 often needs >10m for bun install + CLI zip under shared runners.
+    timeout-minutes: 12
     strategy:
       matrix:
         os: [windows-2025, windows-2022]

.sonarcloud.properties

@@ -6,7 +6,7 @@ sonar.githubactions.activate=false
 
 # private/** is the private E2E/CLI MCP test submodule (Cap-go/cli-mcp-tests); same
 # rationale as tests/** and playwright/** — harness placeholders are not prod code.
-sonar.exclusions=.github/workflows/**,.github/scripts/**,cli/**,scripts/**,tests/**,scriptable/**,.cursor/**,playwright/**,private/**,formkit.theme.ts,sql/**,read_replicate/schema_replicate.sql,supabase/seed.sql,supabase/tests/**,supabase/schemas/**,supabase/migrations/**,src/components/comp_def.ts,supabase/functions/_backend/utils/supabase.types.ts,supabase/functions/_backend/plugin_runtime/utils/supabase.types.ts,src/types/supabase.types.ts,packages/capacitor-notifications/android/src/main/AndroidManifest.xml,**/packages/capacitor-notifications/android/src/main/AndroidManifest.xml,packages/capacitor-notifications/android/build.gradle
+sonar.exclusions=.github/workflows/**,.github/scripts/**,cli/**,scripts/**,tests/**,scriptable/**,.cursor/**,playwright/**,private/**,formkit.theme.ts,sql/**,read_replicate/schema_replicate.sql,supabase/seed.sql,supabase/tests/**,supabase/schemas/**,supabase/migrations/**,src/components/comp_def.ts,supabase/functions/_backend/utils/supabase.types.ts,supabase/functions/_backend/plugin_runtime/utils/supabase.types.ts,src/types/supabase.types.ts,packages/capacitor-notifications/android/src/main/AndroidManifest.xml,**/packages/capacitor-notifications/android/src/main/AndroidManifest.xml,packages/capacitor-notifications/android/build.gradle,packages/react-native-updater/android/build.gradle
 # plugin_runtime is an intentional isolate copy of former shared utils so plugin
 # hot paths never import API code; CPD noise from that split is expected.
 sonar.cpd.exclusions=.github/workflows/**,.github/scripts/**,cli/**,scripts/**,tests/**,scriptable/**,.cursor/**,playwright/**,private/**,formkit.theme.ts,sql/**,supabase/seed.sql,supabase/migrations/**,supabase/functions/_backend/utils/conversion.ts,supabase/tests/**,supabase/functions/_backend/plugins/updates_lite.ts,supabase/functions/_backend/utils/pg_lite.ts,supabase/functions/_backend/utils/supabase.types.ts,supabase/functions/_backend/plugin_runtime/**,src/types/supabase.types.ts,src/components/comp_def.ts,src/services/conversion.ts
@@ -16,10 +16,12 @@ sonar.cpd.exclusions=.github/workflows/**,.github/scripts/**,cli/**,scripts/**,t
 # package and Gradle configuration, while the generated native graph is rebuilt
 # during mobile CI. The notification package manifest is an Android library
 # manifest; host apps own their backup and data-extraction policy.
-sonar.issue.ignore.multicriteria=e1,notificationAndroidLibraryBackup,notificationPluginGradleLock
+sonar.issue.ignore.multicriteria=e1,notificationAndroidLibraryBackup,notificationPluginGradleLock,rnUpdaterPluginGradleLock
 sonar.issue.ignore.multicriteria.e1.ruleKey=text:S8569
 sonar.issue.ignore.multicriteria.e1.resourceKey=android/build.gradle
 sonar.issue.ignore.multicriteria.notificationPluginGradleLock.ruleKey=text:S8569
 sonar.issue.ignore.multicriteria.notificationPluginGradleLock.resourceKey=packages/capacitor-notifications/android/build.gradle
+sonar.issue.ignore.multicriteria.rnUpdaterPluginGradleLock.ruleKey=text:S8569
+sonar.issue.ignore.multicriteria.rnUpdaterPluginGradleLock.resourceKey=packages/react-native-updater/android/build.gradle
 sonar.issue.ignore.multicriteria.notificationAndroidLibraryBackup.ruleKey=xml:S6358
 sonar.issue.ignore.multicriteria.notificationAndroidLibraryBackup.resourceKey=packages/capacitor-notifications/android/src/main/AndroidManifest.xml