fix(rules): invalidate browser guard cache dependencies

[aidenybai]

What changed

The sidecar fingerprint for no-unguarded-browser-global-in-render-or-hook-init now includes imported hydration Hooks, aliases, barrel re-exports, tsconfig resolution, unresolved candidates, and the owning package manifest.

Why

The rule can follow imported Hooks to prove hydration safety, but its cache collector previously fingerprinted only package.json. Editing an imported guard could therefore replay a stale diagnostic or stale clean result.

Regression review

• extends the existing forwarded-function collector instead of adding a second traversal
• covers aliases, barrel re-exports, repeated memoized collection, unrelated imports, unresolved candidates, and cycles
• cycle traversal is finite; node_modules recursion remains excluded to match rule behavior
• Windows CI caught a non-portable expected-path assertion; it now follows the existing native probe-path contract
• complete plugin suite: 24,796 passed, 201 skipped
• full repository tests, lint, typecheck, formatting, JSON-report smoke test all pass
• React Doctor changed-scope scan: 100/100, no issues
• patch changeset included

This PR is independent and targets main.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1479

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1479

npm i https://pkg.pr.new/react-doctor@1479

commit: 689ec06

[github-actions]

Interactive terminal E2E

Recorded from the built CLI at 689ec06 in a real terminal. The fixture holds Git busy for three seconds, so Scanning... must appear immediately after project selection, then exercises the compact interactive report.

Download the GIF and MP4 artifact