chore: make the dependency consistency constraint auto-fixable

[cryptodev-2s]

Explanation

expectConsistentDependenciesAndDevDependencies requires every workspace to use the same version range for a dependency, but it reports through dependency.error(), which Yarn has no way to repair. So yarn constraints --fix does nothing for it and a human has to hand edit every manifest.

That mostly hurts on Dependabot PRs. Dependabot's security updates walk manifests one at a time rather than treating the Yarn workspace as one project, so they routinely bump a dependency in some packages and not others. The result is a red build on a change nobody actually has to think about. PR #10147 is a good example: it bumped uuid in 22 packages, uuid is declared in 24, and the two stragglers fail constraints. Same story on #10157, #10177 and #9369, which is a large part of why uuid alone accounts for 25 of our open Dependabot alerts.

This makes the rule fixable. When every conflicting range is plain semver, the one permitting the highest minimum version wins and dependency.update() aligns the rest, so yarn constraints --fix (which yarn lint:fix already runs) repairs a partial bump on its own.

The previous docstring said it is impossible to compare NPM version ranges, so let the user decide. That is still true in general, and the fallback is unchanged: anything that is not a plain semver range, so aliases like npm:foo@^1.0.0, protocols like workspace:^, or dist tags, still produces the original "Pick one" error with the same wording. The narrower claim here is only that semver.minVersion() is comparable when every range has one, and getHighestRange bails out the moment one doesn't.

Nothing else in the file changes. ALLOWED_INCONSISTENT_DEPENDENCIES and its filter behave exactly as before.

Verification

There is no test harness for yarn.config.cjs, so I verified against the monorepo itself:

Case	Result
Clean tree	exit 0, no manifests modified
uuid bumped in one package only	--fix aligned all 25 manifests, re-check clean
One range set to npm:uuid@^14.0.2	errors with "Pick one", modifies nothing
One package downgraded to ^8.0.0	pulled back up to ^9.0.1, not propagated down

The last one is the safety property worth calling out: a wrong range in one manifest gets corrected upward rather than dragging every other package backwards.

Worth knowing that --fix also reaches the root package.json, which declares some of these dependencies too.

Trade off

Aligning to the highest range is a real dependency change, not a formatting fix. One bump in one package can move the rest onto a new major, and yarn lint:fix will do that locally without asking. The argument for it is that the constraint already requires these to move together, so the only open question was who performs the alignment and in which direction, and aligning downward would mean reverting security fixes.

References

Part of WPC-1161. This is the first step toward dropping the @metamask/* allowlist in .github/dependabot.yml so we can bump everything, not just MetaMask packages. The follow up is a workflow on bot PRs that runs yarn constraints --fix, yarn dedupe and yarn changelog:validate --checkDeps --fix, modelled on the one snaps already has in update-pull-request.yml.

Related to #10147, #10157, #10177, #9369.

Checklist

• I've updated the test suite for new or updated code as appropriate (no harness exists for yarn.config.cjs, see Verification above)
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed (no published package is touched)
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them