Pin react-on-rails-rsc to an explicit version range in packages/react-on-rails-pro (currently "*")

[justin808]

Summary

packages/react-on-rails-pro/package.json pins react-on-rails-rsc: "*". Replace the wildcard with an explicit version range once react-on-rails-rsc@19.0.5 reaches npm latest.

Why

• * auto-adopts any future stable the moment it's published (e.g. 19.0.5, and later the 19.2.x line with its react ^19.2 peer requirement) with no coordinated upgrade or review — a silent-breakage channel for every Pro installation.
• Semver * never matches prereleases, so RC rollouts already require explicit overrides — the wildcard provides convenience to no one while making resolution context-dependent.
• The RSC package's versioning policy (being formalized in shakacode/react_on_rails_rsc — package line tracks the React runtime line) makes an explicit range the only way to express which React line Pro supports.

Tasks

• Replace "*" with an explicit range (suggest ^19.0.5 now; bump deliberately to the 19.2.x line when Pro adopts the React 19.2 runtime).
• Verify react_on_rails_pro/spec/dummy (and any other lockfile consumers) resolve and pass RSC specs with the pin.
• Add a Dependabot/Renovate rule (or document the manual bump process) so future react-on-rails-rsc bumps are reviewed PRs.
• Document the version coupling in the Pro docs (which package line ↔ which React line).

Acceptance criteria

• Explicit pin merged; dummy app + CI green.
• Bump process documented/automated.

Dependencies

• Blocked by (hard): react-on-rails-rsc@19.0.5 promoted to latest (Release: 19.0.5-rc.8 with PR 54, downstream verification, promote 19.0.5 to latest react_on_rails_rsc#65).

Part of the react_on_rails_rsc improvement plan (Batch C), filed here because the change lives in this monorepo.

[justin808]

Batch status update:

• Rechecked npm: pnpm view react-on-rails-rsc version returns 19.0.5.
• React on Rails PR Allow Pro RSC peer check for React 19.2 #4026 has merged, and release tracker Release gate: react_on_rails 17.0.0 #3823 now records the React/RSC 19.2 final path instead of the older 19.0.5 stable-pin path.
• The 19.0.5 draft PR Pin RSC installs to stable 19.0.5 #3988 is therefore closed as superseded. I am leaving this issue open because the explicit-range/pin follow-up is still needed for the 19.2 line once react-on-rails-rsc@19.2.0-rc.1 is published.

Current blocker: shakacode/react_on_rails_rsc PR #102 / package publish for the 19.2 runtime line. Next local action after that external state changes: open/update the React on Rails pin PR for generator defaults, package metadata/lockfiles, docs, and Pro checks against the 19.2 package.