[ISSUE #10042]✨Upgrade SRE UI dependencies and GitHub Actions

[mxsm]

Which Issue(s) This PR Fixes(Closes)

• Fixes [Enhancement✨] Consolidate pending SRE UI and GitHub Actions upgrades #10042

Brief Description

Consolidate 11 SRE UI dependency upgrades and five GitHub Actions upgrades from both pages of pending PRs. Update rocketmq-ai/rocketmq-sre/ui/package.json and its lockfile, and use import.meta.dirname in Vite aliases for native configuration loading. Keep TypeScript pinned to 5.9.3 for openapi-typescript compatibility.

UI dependency	Version	Source PR
@types/react-dom	19.2.5	#9899
eslint-plugin-react-refresh	0.5.5	#9898
vitest	4.1.11	#9897
typescript-eslint	8.69.0	#9896
eslint	10.9.1	#9895
vite	8.2.2	#9894
@types/node	26.4.0	#9893
lucide-react	1.34.0	#9892
@vitejs/plugin-react	6.1.0	#9891
@testing-library/user-event	14.6.6	#9890
globals	17.11.0	#9549

Upgrade checkout to v7 (#9544), upload-artifact to v7 (#9543), download-artifact to v8 (#9545), Buildx to v4.3.0 (#9585), and Syft download to v0.24.2 (#9943). Verify pinned commits against the official repositories and synchronize docker/container-policy.json, scripts/architecture-validation-inventory.json, the Kubernetes guard, and the release workflow test. Preserve existing SHA pin enforcement.

Coverage of all 30 reviewed PRs: 16 targets applied, nine older or obsolete-path requests consolidated (#9796, #9744, #9718, #9717, #9716, #9715, #9610, #9356, #9354), and four crate requests already covered by jsonschema 0.52.1 and uuid 1.26.0 (#9797, #9798, #9747, #9743). Rust 1.120.0 (#9996) is excluded because its official distribution manifest returns HTTP 404; Rust 1.95.0 remains selected.

How Did You Test This Change?

UI commands ran from rocketmq-ai/rocketmq-sre/ui with Node 24.15.0, satisfying the existing jsdom engine requirement. No runtime policy or test timeout was relaxed.

Command	Result
npm install --package-lock-only --ignore-scripts with the 11 explicit target versions above	Passed; regenerated lockfile
npm ci	Passed
npm run check:api	Passed
npm run lint	Passed, including after the Vite configuration update
npm run test -- --run	Final run passed: 30 files, 92 tests. Initial concurrent run had two 5-second timeouts; the unchanged timeout passed on rerun
npm run build	Passed; TypeScript and Vite build
python scripts/container_image_guard.py	Passed
.\scripts\check-agents-routing.ps1	Passed
git diff --check	Passed
actionlint -shellcheck= -pyflakes= on the 11 changed workflows	Same two existing unknown self-hosted runner-label findings as baseline
actionlint -shellcheck= -pyflakes= -config-file with a temporary config registering the existing rocketmq-release-candidate label	Passed for all 11 workflows; tracked lint configuration unchanged. ShellCheck and Pyflakes were not run
python scripts/kubernetes_assets_guard.py	Failed with the same seven baseline findings; no new findings
python scripts/architecture_documentation_guard.py --check	Failed with the same 58 baseline findings; no new findings
python -m unittest scripts.tests.test_m11_container_foundation scripts.tests.test_m11_kubernetes_assets scripts.tests.test_release_binary_build scripts.tests.test_publication_handoff_runner -v	59 of 61 passed; the same two failures occur on baseline
npm audit --package-lock-only --json	Same two high findings as baseline: @redocly/openapi-core and js-yaml

Compared failures against a clean archive of base commit 943c5b91c32c48d0acf82ef4164ea7d935451c52. Kubernetes findings are 39 generated resources versus 45 expected, five missing OTLP endpoint entries, and NetworkPolicy set drift. Architecture findings concern existing test inventory, a broken local link, and generated-document drift. The failing contract tests are test_repository_contract_passes (Kubernetes drift) and test_powershell_runner_prepares_real_release_archive_layout (existing fixture missing the oci directory).

No Rust source or Cargo manifest changed, so Cargo validation was not applicable. Remote CI completion is not a merge prerequisite for this PR, as explicitly requested by the maintainer.

[rocketmq-rust-bot]

🔊@mxsm 🚀Thanks for your contribution🎉！

💡CodeRabbit(AI) will review your code first🔥！

Note

🚨The code review suggestions from CodeRabbit are to be used as a reference only, and the PR submitter can decide whether to make changes based on their own judgment. Ultimately, the project management personnel will conduct the final code review💥.