chore(deps): bump vite-plus to v0.2.0

[fengmk2]

Summary

Bump vite-plus and related packages to the pkg.pr.new prerelease build for v0.2.0.

Updated where applicable:

• vite-plus -> pkg.pr.new build
• vite (alias/override -> @voidzero-dev/vite-plus-core)
• vitest pinned to bundled 4.1.9 (the @voidzero-dev/vite-plus-test wrapper was removed upstream; vitest is now plain upstream)
• minimumReleaseAge enabled with vite-plus packages excluded (pnpm/bun/npm as applicable)
• moved the pnpm.overrides field from package.json into pnpm-workspace.yaml (the pnpm field is no longer read by pnpm)

Test plan

• CI passes

[gemini-code-assist]

Code Review

This pull request updates the vite-plus dependency to a temporary pkg.pr.new URL in both the template package.json and the workspace configuration, along with updating the lockfile. It also introduces minimumReleaseAge and minimumReleaseAgeExclude settings to pnpm-workspace.yaml. Feedback highlights two critical issues: first, using an ephemeral pkg.pr.new URL in a template meant for end-users will eventually break the template; second, the minimumReleaseAge configurations are .npmrc options and will be ignored if placed in pnpm-workspace.yaml.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Using a temporary pkg.pr.new URL in a template package.json meant for end-users is highly discouraged. These URLs are ephemeral and can be garbage-collected or deleted, which will break the template for anyone using create-rari-app in the future. Please use a published npm version (or a prerelease tag like ^0.2.0-beta.0) instead.

[gemini-code-assist]

The minimumReleaseAge and minimumReleaseAgeExclude settings are .npmrc configuration options (typically configured as minimum-release-age and minimum-release-age-exclude in kebab-case) rather than pnpm-workspace.yaml options. Placing them here means they will be ignored by pnpm, leaving the security feature inactive. Please move these configurations to your .npmrc file.