fix(react): address PR #2024 review feedback

Critical:
- Remove undefined/.claude/session-aliases.json containing __proto__ prototype-pollution
  fixture committed by accident in a7333c14

High:
- agents/react-build-resolver.md: replace brittle `test -o $(grep -l ...)` and
  `test -a -n $(grep ...)` detection with explicit `{ ... || grep -q ...; }` so
  bundler detection no longer breaks when grep returns empty
- agents/react-build-resolver.md: drop hardcoded `npm i react@^19 react-dom@^19`
  remediation; replace with version-agnostic pair-upgrade note that honors the
  project's installed major (17/18/19) — surgical fix principle
- commands/react-review.md: guard `tsc --noEmit -p tsconfig.json` with
  `[ -f tsconfig.json ] &&` so the review skips cleanly on JS-only projects

Medium:
- rules/react/security.md: correct the React-18-blocks-javascript-URL claim
  (React only warns in dev; production navigation is not blocked)
- rules/react/security.md: correct CRA env-var exposure row (CRA exposes
  REACT_APP_*, NODE_ENV, PUBLIC_URL — not 'all' variables)
- skills/react-testing/SKILL.md: instantiate QueryClient once outside the
  wrapper closure so React Query cache survives re-renders (flaky-test fix)
- skills/react-testing/SKILL.md: restore console.error spy with mockRestore()
  in a try/finally so the mock does not leak across tests
- commands/react-test.md: switch outer example-session fence to 4 backticks
  so the inner ```tsx/```bash blocks don't prematurely terminate it

agents/react-build-resolver.md

@@ -43,8 +43,8 @@ test -f vite.config.js -o -f vite.config.ts -o -f vite.config.mjs   # Vite
 test -f rsbuild.config.js -o -f rsbuild.config.ts                   # Rsbuild
 grep -l "react-scripts" package.json                                # CRA
 test -f webpack.config.js -o -f webpack.config.ts                   # webpack
-test -f .parcelrc -o $(grep -l 'parcel' package.json)              # Parcel
-test -f bunfig.toml -a -n "$(grep '"bun"' package.json)"           # Bun
+{ test -f .parcelrc || grep -q '"parcel"' package.json; }          # Parcel
+{ test -f bunfig.toml && grep -q '"bun"' package.json; }           # Bun
 ```
 
 ## Diagnostic Commands
@@ -160,7 +160,10 @@ Common triggers:
 npm ls react                       # check for duplicates
 npm ls @types/react                # check version alignment
 npm dedupe                         # consolidate duplicates
-npm i react@^19 react-dom@^19      # upgrade as a pair, never independently
+# Only when `npm ls react` reports duplicates or a version mismatch with `@types/react`.
+# Upgrade react and react-dom as a pair (matching the major already in use) — never independently.
+# Replace <major> with the project's React major (17 / 18 / 19); jumping majors is a separate, deliberate change.
+# npm i react@^<major> react-dom@^<major>
 ```
 
 When a library throws on hook usage, it almost always means React is duplicated.