fix(deps): remove legacy peer deps without downgrading ESLint

[Tatsat (Tats) Mishra 🐉 (Tatsinnit)]

Summary

Fixes #2038.

• Remove all five --legacy-peer-deps occurrences from the shared install script and fuzzing workflows.
• Keep ESLint 10 and replace eslint-plugin-react with @eslint-react/eslint-plugin 5.19.0. The published legacy plugin still excludes ESLint 10 from its peer range (ESLint v10 compatibility jsx-eslint/eslint-plugin-react#3977).
• Upgrade the webview TypeScript-ESLint parser/plugin to 8.69.0 and deduplicate their dependency trees. No package-version downgrades were found in either lockfile.
• Map React checks explicitly, retain the existing React Hooks plugin and suppression names, fix two missing fragment keys, and add five lint-config regression tests to build CI.

Coverage Tradeoffs

This is not an exact preset swap. The migration documentation records the differences:

• Display-name checks now cover anonymous wrapped components and contexts rather than every previously checked component form.
• Several checks move to TypeScript/React 19 type validation, including duplicate explicit JSX attributes, unresolved JSX names, typed props, string refs, removed isMounted calls, and missing class render returns. They require the TypeScript build and do not protect untyped any usage.
• react/no-unescaped-entities has no replacement and is no longer enforced.
• The broader replacement recommended preset is deliberately not enabled, avoiding unrelated rule changes and duplicate Hooks checks.

Lockfiles

The root lockfile only reclassifies 59 entries from dev to devOptional after normal peer resolution; versions and integrity hashes are unchanged. The webview lockfile removes the old plugin dependency tree and consolidates the upgraded TypeScript-ESLint dependencies while retaining lockfile version 2.

Validation

Passed locally on macOS with Node 22.22.1 / npm 11.17.0:

• Clean npm ci --legacy-peer-deps=false --no-audit --no-fund in both projects.
• npm_config_legacy_peer_deps=false npm run install:all.
• npm run lint:all.
• npm run test:lint --prefix webview-ui: 5 passing.
• npm test: 289 passing in the VS Code test host.
• npm run test:fuzz: 28 passing.
• npm run test:scripts: 53 passing.
• npm run package: production webpack and VSIX packaging passed.
• npm 10 flag-free CI dry-run checks also passed.
• Formatting and git diff --check passed.

The webview audit reports zero vulnerabilities. The root retains four findings in unchanged dependencies (two moderate, two high), outside this migration. Cross-platform CI is pending.