fix(ci): harden upgrade-deps script for slash-escaping and mocker patch sync

- Switch `replace('/', '\\/')` to `replaceAll` in both regex builders so a
  future vitest sub-key with multiple slashes can't silently produce a
  broken pattern.
- Always persist `updateVitestMockerPatch`'s in-memory rewrite when the
  content changed, not only when the key version moved — fixes a case
  where the key already matches `vitestVersion` but the value's patch-file
  suffix is stale, which would otherwise leak through and trigger
  ERR_PNPM_PATCHED_PKG_DOES_NOT_MATCH on install.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Brooooooklyn

.github/scripts/upgrade-deps.ts

@@ -160,7 +160,7 @@ async function updatePnpmWorkspace(versions: PnpmWorkspaceVersions): Promise<voi
   ];
   const vitestBrowserEntries: PnpmWorkspaceEntry[] = vitestBrowserPackages.map((pkg) => ({
     name: pkg,
-    pattern: new RegExp(`'${pkg.replace('/', '\\/')}': ([\\d.]+(?:-[\\w.]+)?)`),
+    pattern: new RegExp(`'${pkg.replaceAll('/', '\\/')}': ([\\d.]+(?:-[\\w.]+)?)`),
     replacement: `'${pkg}': ${versions.vitest}`,
     newVersion: versions.vitest,
   }));
@@ -311,7 +311,7 @@ async function updateTestVpCreateWorkflow(vitestVersion: string): Promise<void>
   ];
   let updated = content;
   for (const key of vitestKeys) {
-    const pattern = new RegExp(`"${key.replace('/', '\\/')}":"([\\d.]+(?:-[\\w.]+)?)"`);
+    const pattern = new RegExp(`"${key.replaceAll('/', '\\/')}":"([\\d.]+(?:-[\\w.]+)?)"`);
     let matched = false;
     updated = updated.replace(pattern, (_match: string, _captured: string) => {
       matched = true;
@@ -365,9 +365,15 @@ async function updateVitestMockerPatch(vitestVersion: string): Promise<void> {
       );
     }
     fs.renameSync(oldPatch, newPatch);
-    fs.writeFileSync(filePath, updated);
     console.log(`Renamed @vitest/mocker patch ${oldVersion} -> ${vitestVersion}`);
   }
+  // Also covers the case where the key version already matches `vitestVersion`
+  // but the value's patch-file suffix had drifted — `content.replace` repaired
+  // the line in memory and we must persist it, otherwise pnpm install can hit
+  // ERR_PNPM_PATCHED_PKG_DOES_NOT_MATCH.
+  if (updated !== content) {
+    fs.writeFileSync(filePath, updated);
+  }
   recordChange('@vitest/mocker patch', oldVersion, vitestVersion);
 }