chore: anchor vite 8 (#4790)

* chore: have renovate hold PRs for 3 days after release

Recent renovate PRs went red because freshly-published versions
weren't fully propagated on the npm registry / CDN. `minimumReleaseAge`
delays PRs until the version is at least three days old, and
`internalChecksFilter: "strict"` suppresses the PR entirely until
that window passes rather than opening it and blocking merge.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: anchor vite to ^8 in root devDependencies

Without a root-level vite, pnpm peer-resolves vitest@4 against the
vite@5.4.21 that vitepress pulls in, which lacks the ./module-runner
subpath vitest needs and breaks lockfile-maintenance refreshes
(see PR #4786). Anchoring vite at ^8 (within vitest 4's declared peer
range of ^6 || ^7 || ^8) keeps the topology stable across regens
while vitepress retains its own scoped vite@5.

Also tightens the coverage `include` glob to *.{ts,js,mjs,cjs} so
vitest 4's uncovered-files pass under vite@8 stops trying to parse
commitlint.schema.json as JavaScript.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>