chore: upgrade app modules to React Native 0.86

[huhuanming]

Summary

• upgrade React Native and the matching React Native toolchain to 0.86.2
• upgrade react-native-nitro-modules and nitrogen to 0.36.5
• upgrade the example app to react-native-mmkv 4.3.2
• align the example iOS deployment target to 16.4
• update all publishable app module packages and templates to the compatible dependency set
• ensure the iOS background runtime starts only after the React Native bridge is ready

Validation

• app-monorepo Android release consumer build completed successfully
• runtime smoke-tested on Android API 26, 29, 34, 35, and 36
• verified both gesture and three-button navigation where supported

Release

• all 35 public packages are available as 3.0.90 under the npm next dist-tag

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​react-native/​metro-config@​0.83.0 ⏵ 0.86.2
	npm/​@​react-native/​typescript-config@​0.83.0 ⏵ 0.86.2
	npm/​@​react-native/​new-app-screen@​0.83.0 ⏵ 0.86.2
	npm/​@​react-native-community/​cli@​20.0.0 ⏵ 20.1.0			+1
	npm/​@​react-native/​jest-preset@​0.86.2
	npm/​react-test-renderer@​19.2.0 ⏵ 19.2.3
	npm/​@​react-native/​babel-preset@​0.83.0 ⏵ 0.86.2	+1
	npm/​react@​19.2.0 ⏵ 19.2.3
	npm/​@​react-native/​eslint-config@​0.83.0 ⏵ 0.86.2	+1		+9
	npm/​@​react-native-community/​cli-platform-android@​20.0.0 ⏵ 20.1.0
	npm/​@​react-native-community/​cli-platform-ios@​20.0.0 ⏵ 20.1.0
	npm/​react-native@​0.83.0 ⏵ 0.86.2	+12		+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• npm/@react-native/debugger-frontend@0.86.2

View full report

[huhuanming]

Addressed both P1 findings from the automated review in commit 6c570ab:

• Regenerated example/react-native/ios/Podfile.lock so all local pods and spec checksums match version 3.0.90.
• Updated scripts/setup-nitro-module.js to resolve Hermes from hermes-compiler/package.json and use hermesc/%OS-BIN%/hermesc, matching React Native 0.86.

Validation completed:

• bundle exec pod install --deployment: passed with no lockfile changes
• BackgroundThread iOS simulator scheme: build succeeded
• Android example arm64-v8a debug APK: build succeeded
• setup script syntax check and resolved Hermes compiler existence check: passed

The Socket obfuscated-code warning does not require a dependency change: @react-native/debugger-frontend 0.86.2 is an official React Native package sourced from facebook/react-native and is pinned transitively by @react-native/dev-middleware 0.86.2. The published debugger UI is bundled/minified, which is what triggers this heuristic; the package version and integrity are locked, so I am treating it as acceptable risk for this PR.

[huhuanming]

@SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.2