ci: run the test suite against React 19 (#789)

[tyler-reitz]

Why

CI type-checks React 19 but has never executed a test against it: the react matrix exists only on the type-check job, while the test job runs the lockfile's React 18. This adds React 18/19 as a test-job dimension so the suite actually runs on 19, before any src/ change lands for the React 19 foundation.

It found a real bug in its first run, which is the argument for landing this leg first: #793.

What

• test job matrix gains react: ["18", "19"], so 2 jobs become 4. The 18 legs run the lockfile as-is; the 19 legs install react@19 react-dom@19 --no-save.
• The 18 legs keep their existing job names, so main's required status checks keep matching and no admin change is needed. Only the 19 legs get a suffix. A consequence worth stating: a React 19 failure will not gate a merge while 19 support is still being built. Add the contexts when we want it to.
• A guard step after the artifact overlay asserts the installed React matches the matrix leg. Without it the dimension is decorative, since the only behavioural difference between the legs is one skipped test, so a 19 leg silently running 18 would pass green.
• @testing-library/react 14 → 16, plus @testing-library/dom as a direct dependency. Forced, not opportunistic: RTL 14 declares React ^18 only, so the 19 leg cannot run without it. The lockfile shrinks because RTL 14's nested copy collapses into the top-level install; no packages are added.
• One test is skipped on React 19 only, tracked in Suspense mode resumes with the previous observable's value on React 19 #793.

Notes

• Emulator jobs go from two to four, which doubles per-PR exposure to the CI: test/firestore.test.tsx flakes intermittently on both Node 22 and Node 24 #776 flake. test(firestore): wait out the emulator's Listen-stream backoff #791 is the mitigation for that.
• The React 16/17 drop and the peerDependencies change are deliberately not here; they are a separate review.

Refs #789