Merge remote-tracking branch 'origin/main' into jg-conductor/3313-fix

* origin/main: (26 commits)
  docs: define security-supported versions policy (#3261) (#3341)
  Bump version to 16.7.0.rc.2
  Update CHANGELOG.md for 16.7.0.rc.2 (#3393)
  Fail release on unverifiable or Yarn-incompatible npm packages (#3387)
  Bump version to 16.7.0.rc.1
  [codex] Prepare 16.7.0.rc.1 changelog (#3384)
  fix(tanstack-router): remove Suspense gate around RouterProvider during hydration (#3213)
  chore(deps): bump the npm-security group across 1 directory with 3 updates (#3370)
  fix: add reactDomClientWarning helper for React 16/17 (#3137) (#3358)
  docs: document RSC node renderer globals (#3221)
  fix(pro): preserve react-on-rails-rsc/client.browser in client bundle (#3366) (#3368)
  Allow Pro 16.7 to keep jwt 2.x compatibility (#3344)
  Plan: flagship 2026 React on Rails starter kit (#3357) (#3364)
  docs: clarify coupled gem/npm/lockfile upgrade for React on Rails Pro (#3369)
  chore(deps): bump fastify from 5.8.3 to 5.8.5 in the npm-security group across 1 directory (#3152)
  docs: clarify initial security triage ownership in SECURITY.md (#3337)
  docs: consolidate node renderer probe settings (#3257) (#3348)
  chore(ci): remove obsolete setup-node-with-retry action (#3352)
  chore: remove completed planning/analysis docs (#3361)
  test: stub stable VERSION in --pro install spec to unblock CI (#3363)
  ...

Author: justin808