The dependency-health script now allowlists packages that are
deliberately pinned to a different major than the rest of the
monorepo:

- spa-checkout mirrors Lovable's default stack (React 18 + Vite 5 +
  Tailwind v3), so React 18/19 and Vite 5/8 drift against the core
  workspace is expected and must not fail CI.
- @example/mcp-time-app is a demo for the MCP App SDK which ships on
  Vite 8.

Also tighten the @solvapay/* prerelease detector to match strict
semver prerelease strings (/^\d+\.\d+\.\d+-[0-9A-Za-z.-]+\$/) and
skip file: specifiers. pnpm -r ls reports workspace-resolved peers as
file:packages/react(react@18.3.1)(...) and the bracketed peer tree
can contain '-' for packages like react-dom, which previously
false-flagged as a prerelease version.

Unblocks publish-preview.yml on feature/sdk-gaps-for-lovable-skill.

Made-with: Cursor