[yordis]

• Lockfile and pnpm-workspace took upstream's (undici 8.12.4), then vp i re-added the fork-only importers (secret-provider-aws, secret-provider-openbao) and the fork's vitest catalog entries and overrides, so installs stay reproducible for both.
• Root knip:check:exports takes upstream's line and re-adds the two fork-only secret-provider workspaces, so knip keeps covering them.
• Mobile package.json takes upstream's nitrogen and babel-preset-expo bumps and keeps the fork's vitest: catalog: devDependency.
• ci.yml and mobile-eas-production.yml keep the fork's ubuntu-24.04 runners where the fork had them (Release Smoke, the production job) and take upstream's timeout, concurrency and new android/ios jobs, which stay on blacksmith runners.
• ProviderSessionManager keeps the fork's unload structure (metrics, delegated-child and eager handling) and adds upstream's linked-environment cleanup after unload plus its new unload/release-for-linked-environments methods, so both behaviors hold.
• settingsSecrets keeps both the fork's secret-provider mapping and upstream's text-generator mapping; clientRpcPermissions and client-runtime server state keep both checkSecretSource and listTextGeneratorModels for the same reason.
• PullRequestCodeTab drops the fork's onRevealSearchMatch prop because upstream moved it into diffViewOptions; the fold toggle there is rewritten on the fork's setFoldChoices(setFileDiffFold(...)) since setToggledFiles no longer exists.
• serverSettings.test keeps the fork's value import of ProviderInstanceEnvironment, which is used at runtime.
• Glossary takes upstream's table (adds Text generation and Text generator rows); the fork's "Secret reference" row is dropped because nothing links to it any more.
• Fork ledger 0012 (the @legendapp/list padding patch) is removed with its README lines and the 3.3.5 patch file: upstream's 3.7.2 replaces padding inflation with a removable spacer, so the fork fix is obsolete. Ledger 0008, 0010, 0017, 0024, 0031, 0032 and 0033 have no upstream equivalent and are kept.
• Persistence migrations are byte-identical to upstream, and no .repos changes came in, so no sync:repos run was needed.
• The agent context budget rises (5366/7096/48261 to 5549/7279/48375) because upstream's new instructions are larger; the agent-context-budget check will flag this since it rejects increases over main.
• Unpinned actions that arrived with upstream (checkout, upload-artifact, setup-java, setup-node, expo-github-action, useblacksmith/stickydisk) are pinned to SHAs in a separate commit. useblacksmith/stickydisk is not on the org allowlist, so the android/ios jobs in mobile-eas-production may fail at startup on this fork until it is allowed or replaced.
• DCO is expected to fail because upstream commits carry no sign-off.

[cursor]

This PR is too large for Bugbot to review. It changes 103,948 lines and 4,035,070 characters. Split the change into smaller pull requests to get a review.