Resolve user-stub star re-exports through the active typeshed; fix lost preview-discard intent; path-restrict the Dependabot sweep

[abdushakoor12]

TLDR

Fixes false imports_module_attribute errors when a user stub star-re-exports from a module owned by the active Typeshed source (the MicroPython uio.pyi → from io import * case, GitHub #312 follow-up), fixes a lost-cancelPreview race in the configuration editor's impact dialog, and makes the Dependabot sweep path-restricted so security-bump sweeps can no longer fail on workflow-file pushes (the failure that stranded #340).

What Was Added?

• parse_snapshot_stub (crates/basilisk-checker/src/exports.rs): the single producer of a snapshot-backed StubModule, extracted from the cross-module loader closure so the re-export fallback gets the same target-filtered parse.
• reexported_member_names_with_fallback (crates/basilisk-stubs/src/reexports.rs): like reexported_member_names, but consults a fallback loader for star targets that don't resolve inside the stub's own source root. Local resolution always wins; the fallback never overrides a sibling stub.
• discardPreview() in the configuration editor webview runtime: every user-initiated dialog dismissal (Cancel button, Escape) posts cancelPreview synchronously with the action.
• A workflow-file guard in the Dependabot sweep: a bump that itself edits .github/workflows/* is left open with an explanatory comment (the Actions token cannot push workflow files by construction) instead of failing the job.
• .vscode-test.mjs honours BSK_TEST_GREP so one webview test can be run in isolation.
• Five integration tests in import_apply_tests.rs and one end-to-end CLI test (see below).
• linkify-it 5.0.1 → 5.0.2 (transitive dev dependency of @vscode/vsce) in the vscode-extension and website lockfiles.

What Was Changed or Deleted?

• build_stub_api (crates/basilisk-checker/src/imports/apply.rs) now takes the import search paths and falls back to the active step-3 Typeshed snapshot when a user stub's star target doesn't resolve beside the stub — so uio.pyi containing only from io import * picks up io's members from the custom typeshed's stdlib/ tree instead of producing "Module uio has no attribute StringIO" on every re-exported name.
• Configuration editor discard reporting: the webview previously told the host a preview was discarded only from the <dialog> close event, which Chromium dispatches on a queued element task — an occluded webview's throttled task queue can drop it, silently losing the discard and leaving the host holding a pending preview. The Cancel/Escape paths now post synchronously; the close listener remains as a guarded, double-post-proof fallback re-armed per preview state.
• .github/workflows/dependabot-automerge.yml: the sweep no longer git merges the whole bump branch into dependabot-upgrades. It copies exactly the PR's own changed paths (merge-base diff, deletions included) onto the live staging tip. A full merge of a security bump (based on current main) into a drifted staging branch dragged main's workflow-file edits along, and the push was rejected — the workflows scope cannot be granted to GITHUB_TOKEN. Path-copying makes the sweep immune to staging-branch drift while keeping clobber semantics (latest bump of a file wins) and the retry-on-race loop.
• make_custom_typeshed test helper now emits one VERSIONS line per top-level module, so package stubs (asyncio/__init__.pyi + asyncio/tasks.pyi) can be modelled.

How Do The Automated Tests Prove It Works?

• user_stub_star_reexport_from_stdlib_stub_is_captured — mirrors micropython-esp32-stubs' uio.pyi verbatim; asserts StringIO/BytesIO land in the captured member API via the snapshot fallback.
• user_stub_star_reexport_follows_stdlib_package_reexports — the chained uasyncio.pyi → from asyncio import * case; proves the walk keeps resolving the stdlib package's own relative re-exports (from .tasks import *) inside the snapshot.
• user_stub_star_reexport_honours_stdlib_dunder_all — a stdlib stub's __all__ stays authoritative across the boundary (BytesIO excluded when absent from __all__).
• user_stub_alias_reexport_from_stdlib_stub_is_captured — the from io import StringIO as StringIO redundant-alias convention crosses the boundary too.
• user_stub_star_reexport_prefers_sibling_stub_over_snapshot — guard: a sibling machine.pyi in the same stub dir shadows a same-named snapshot module; the snapshot is a fallback, never an override.
• cli_accepts_user_stub_reexports_from_the_custom_typeshed_stdlib (e2e, real CLI) — the reporter's exact configuration (stub-paths and typeshed-path both at typings/) checks uio.StringIO()/uio.BytesIO() with exit code 0 and no imports_module_attribute.
• "a dismissed rule preview discards the change and restores the control" (VSIX real-webview DOM test) — previously flaked under full-suite load because the queued close event never fired (instrumentation showed dialog.open flipping with zero close events delivered and no cancelPreview intent reaching the host). The driver now dismisses through the Cancel button exactly as a user would and the test passes deterministically — 793ms vs 5–6s before, since nothing waits on the throttled task queue.
• The workflow change has no automated test (no harness for Actions runs); the sweep script's path-copy, deletion handling, drift immunity, and workflow-file guard were exercised in a scratch-repo simulation of both a security bump and a github-actions bump.

Spec / Doc Changes

docs/specs/CHECKER-STUB-RESOLUTION-SPEC.md ([STUBRES-PYI-REEXPORTS]): documents local-first star-target resolution with fallback to the active step-3 Typeshed source, recursive resolution within whichever source resolved each target, and sibling-shadowing semantics. The dependabot-automerge workflow's header comments were rewritten to describe the path-restricted sweep and the workflow-file constraint.

Breaking Changes

• None