Release 2.5.0 step 2: merge v2/main into main and cut the release

[cliffhall]

Milestone v2.5.0

The fifth v2/main → main milestone merge, cutting 2.5.0. This is step 2 of the release procedure; step 1 (the version bump on v2/main) is #2212 / #2213 and has already landed.

main currently holds 2.4.0 (merged via #2143 / #2145) and has not moved since — no Dependabot PR landed on it directly this cycle. v2/main has accumulated 33 merged PRs (213 non-merge commits) on top of it, closing 37 issues on the v2.5.0 milestone.

Scope

1. Branch from main, merge origin/v2/main.
2. Open a PR against main and run the gate green on the merged tree.
3. After merge: tag origin/main as bare 2.5.0 and draft the GitHub Release — publishing runs pack:verify, asserts the tag matches package.json, and publishes the latest dist-tag.

The version bump is not part of this issue — it landed on v2/main first (#2213), per the #2010 procedure, and arrives here as part of the payload.

Conflicts

None. A trial merge of main with origin/v2/main went through with zero conflicted paths, and the merged tree is byte-identical to origin/v2/main (git diff origin/v2/main HEAD is empty). main's tip is still an ancestor of this branch's first parent — nothing has landed on main since #2145 — so every path three-way merged clean.

Re-check the trial merge before opening the PR anyway: a Dependabot PR merged to main in the interim would reintroduce the lockfile conflict the v2.3.0 merge hit, and any security bumps must survive it.

Payload

Group	PRs
Release mechanics	#2213 (bump to 2.5.0 — #2212)
App.tsx decomposition (#2126)	#2149 (phase 0: module-level block into files — #2127), #2150 (phase 1: leaf hooks — #2128), #2152 (useSessionRef — #2157), #2162 (useOAuthRecovery — #2153), #2166 (useMcpApps — #2156), #2169 (useConnectionLifecycle — #2154), #2173 (useServerCommands — #2155), #2182 (phase 3: InspectorView's prop wall into domain bundles — #2130), #2191 (resolve the react-hooks findings the decomposition unmasked — #2161)
React state correctness	#2193 (read state stores during render instead of re-syncing in an effect — #1955), #2194 (lint core/react/ with eslint-plugin-react-hooks — #2192), #2190 (terminate the five void-discarded OAuth recovery promises — #2165), #2179 (surface failed resource subscribe/unsubscribe — #2174)
Authorization	#2186 (revoke OAuth tokens at the authorization server on clear, RFC 7009 — #2144), #2184 (accept RFC 8414 metadata served at the OIDC well-known path — #2172)
Tools & JSON editing	#2170 (Ace JSON editor everywhere, and the raw-JSON toggle restored — #2151), #2175 (refuse a raw-JSON tool argument the schema would retype — #2171), #2137 (render tool schemas with a root-level anyOf/oneOf — #2123)
Protocol & transport	#2185 (cancel a Streamable HTTP call by closing its stream — #2140), #2176 (say why a never-acknowledged subscriptions/listen ended instead of retrying it eight times — #2097)
Dependency consolidation (#2030)	#2200 (runtime dependencies into the root manifest — #2195), #2199 (shared toolchain devDependencies into the root manifest — #2196)
Smokes, gate & CI (#2031)	#2133 (headless web smokes in Firefox — #2086), #2164 (connected-flow smokes for Tools/Resources/Prompts — #2148), #2158 (smoke:tui asserts survival, not first paint — #2147), #2167 (rename the local pre-push gate off ci — #2146), #2160 (coverage gate in a parallel CI job — #2159), #2178 + #2181 (render-smoke startup budget and clock anchoring — #2177, #2180)
Docs & agent skills	#2189 (extract AGENTS.md recipes into agent skills — #2163), #2203 (tune skill eval cases and document how to write them — #2202)

Three milestone issues closed without a PR of their own: #2126, #2030 and #2031 are parent trackers whose sub-issues carried the work; #2132 (WebKit SSE tail) closed with its cross-chunk parseSSE half shipped in v2.4.0 via #2135, the WebKit matrix entry deliberately left out.

After merge

• Close this issue manually and move its card to Done — a merge PR into main uses References by convention, so no closing keyword fires.
• Close out the v2.5.0 milestone, moving anything still open on it to v2.6.0.