Release js-core dependency removal patches

[leoromanovsky]

Motivation

@datadog/flagging-core@2.0.1 and @datadog/openfeature-node-server@2.0.1 install @datadog/js-core@0.0.3 from DataDog/browser-sdk solely for the timestamp primitive. PR #342 moved that primitive into runtime-agnostic core so Node.js consumers no longer pull browser SDK runtime dependencies. These patch releases make that fix available to package consumers.

Changes

This release advances @datadog/flagging-core from 2.0.1 to 2.0.2, @datadog/openfeature-browser from 1.2.4 to 1.2.5, and @datadog/openfeature-node-server from 2.0.1 to 2.0.2. Browser and Node.js now pin core exactly at 2.0.2, the lockfile reflects those coordinated versions, and the changelog records the dependency removal and packed Node.js purity check.

Decisions

The three packages move together because browser and Node.js deliberately pin core to an exact version. Browser retains its direct browser SDK dependencies; the purity boundary applies to core and node-server. The signed package tags were created locally but were not pushed. After this PR is merged with a merge commit, publish in dependency order: core, browser, then node-server.

Validation

• bash scripts/internal-deps-validate.sh
• bash scripts/versions-validate.sh
• yarn licenses:validate
• yarn lint
• yarn format:check
• BUILD_MODE=release yarn build
• yarn typecheck
• yarn test (457 tests across 22 suites)
• yarn test:browser-install
• yarn test:node-install (7/7 consumer checks)
• yarn test:node-install:with-of (7/7 consumer checks)
• yarn lerna run pack --stream

Validation ran with Node.js v26.5.0.