deps: upgrade devframe to v0.9.11

[antfubot]

Description

Upgrades devframe (and every @devframes/* package) from ^0.9.10 to ^0.9.11 via the shared catalog ref, and aligns the static builder with devframe 0.9.11's buildHub.

What 0.9.11 brings. devframes/devframe#349 (closing the issue this repo filed, devframes/devframe#347) reworked buildHub to accept an already-mounted context — the intent being that Vite DevTools could delete its hand-rolled packages/core/src/node/build-static.ts and reuse the hub's baker.

Why we can't drop build-static.ts onto buildHub({ context }) yet. buildHub bakes the whole hub as a single subtree under one base: its resolveOutPath throws DF8006 for any static dir or served frame whose URL doesn't start with base. Vite DevTools serves the hub UI at /__devtools/ but mounts each built-in devframe SPA at a root-level sibling (/__devframes_plugin_inspect/, /__devframes_plugin_messages/, …) and the vendored assets at /__devtools-assets/ — none under /__devtools/. So copyBuildStatics would throw on the first sibling entry. Full adoption needs either an upstream buildHub that bakes statics/frames living outside the hub base (a deploy-root layout), or restructuring Vite DevTools to nest every devframe + asset under /__devtools/ (a dev- and build-mode serving change). Tracking that separately.

What this PR does align. 0.9.11 records the resolveFrom each static dir was mounted with on ctx.views.buildStaticDirs, and buildHub's copyBuildStatics threads it through resolveStaticAssetsSource. Our builder ignored it, so a plugin devframe's remote --assets bundle (inspect, messages) re-resolved against core's back-proxy CDN cache and could bake a stale SPA. build-static.ts now threads resolveFrom, mirroring buildHub and fixing the latent stale-SPA bug.

Verified with a real cli build: statics resolve to the locally-installed plugin copies and the frame SPAs bake correctly. pnpm typecheck && pnpm test && pnpm lint && pnpm build all pass.

Linked Issues

Relates to devframes/devframe#347 / devframes/devframe#349.

Additional context

The residual 0.9.10/0.8.2 @devframes/* entries in pnpm-lock.yaml come from the published @vitejs/devtools@0.5.2 pulled in transitively by a fixture — pre-existing, unrelated to this bump; the workspace packages all resolve to 0.9.11.

This PR was created with the help of an agent.

[pkg-pr-new]

Open in StackBlitz

@vitejs/devtools

npm i https://pkg.pr.new/@vitejs/devtools@560

@vitejs/devtools-kit

npm i https://pkg.pr.new/@vitejs/devtools-kit@560

@vitejs/devtools-oxc

npm i https://pkg.pr.new/@vitejs/devtools-oxc@560

@vitejs/devtools-rolldown

npm i https://pkg.pr.new/@vitejs/devtools-rolldown@560

@vitejs/devtools-vite

npm i https://pkg.pr.new/@vitejs/devtools-vite@560

@vitejs/devtools-vitest

npm i https://pkg.pr.new/@vitejs/devtools-vitest@560

commit: c115672