fix(ci): hoist expo-module-scripts so root overrides reach its Expo peers (#7998)

`npm audit signatures` in the quality job fails on some runners with
EMISSINGSIGNATUREKEY for @react-native/babel-preset@0.88.0. Nothing in
the repo uses React Native 0.88: the package came from a second Expo SDK
that npm placed under packages/expo-two-way-audio/node_modules because
expo-module-scripts was declared there. Root `overrides` are not applied
to packages nested under a workspace, so jest-expo's `expo@*` peer
resolved to the latest SDK and pulled 200+ duplicate packages into the
lockfile.

The failure itself is a CDN cache problem: one Cloudflare edge (ORD,
which serves GitHub runners in Azure northcentralus) cached the
attestations document for that version seconds after publish, before
the publish attestation existed, and keeps serving the provenance-only
document for a year. Every quality job that lands in that region fails;
every other region passes. The audit code path checks the registry
signature before attestations, so the key list is fine and reruns only
succeed by landing elsewhere.

Declaring expo-module-scripts in the root devDependencies puts it under
the overrides, which removes the nested SDK and the poisoned URL from
the lockfile. The module's tsconfig points its typeRoots at the hoisted
copy; its scripts resolve `expo-module` from the root `.bin`.

Closes #7730

docs/development.md

@@ -542,6 +542,39 @@ patch every build the consumers use: Metro resolves the `react-native` field of
 (`src/*.ts` for `react-native-svg`), while Node and Vitest resolve `main`/`module`
 (`lib/commonjs`, `lib/module`). Patching only `lib/` leaves the app bundle unfixed.
 
+## Dependency overrides and workspace tooling
+
+Root `package.json` `overrides` pin one Expo SDK across the tree (`expo`, `expo-router`,
+`react-native`, …). npm does not apply those overrides to packages it places under a
+workspace's own `node_modules`. When `expo-module-scripts` was declared in
+`packages/expo-two-way-audio`, npm nested it there and its `jest-expo` peer `expo@*` resolved to
+a second, newer Expo SDK and React Native: 200+ duplicate packages nothing imported (#7730).
+Declare tooling that peer-depends on `expo` or `react-native` in the root `devDependencies`,
+where the overrides apply; workspace scripts still find the binary through the root
+`node_modules/.bin`.
+
+## Dependency signature audit
+
+The `quality` CI job runs `npm audit signatures`. It verifies every lockfile package's registry
+signature and, for packages published with provenance, fetches
+`/-/npm/v1/attestations/<name>@<version>` from the registry. Cloudflare caches that document
+for a year. An edge that cached it in the seconds before the registry attached the publish
+attestation keeps serving a document with only the provenance bundle, and npm fails with:
+
+```
+npm error code EMISSINGSIGNATUREKEY
+npm error <name>@<version> has attestations but no corresponding public key(s) can be found
+```
+
+The same package's registry signature verified a moment earlier with the same keys, so the
+key list is intact. The failure names one package, repeats only for that package, and depends
+on the Azure region the runner landed in, because each region maps to one Cloudflare colo. A
+rerun passes only by landing elsewhere.
+
+To confirm, fetch the URL from several runners and compare `content-length`, the `cf-ray` colo
+suffix, and the number of `attestations` entries (#7730 has the probe). To fix, remove or
+replace that version in the lockfile and report the URL to npm so they purge it.
+
 ## ACP provider catalog versions
 
 The in-app ACP provider catalog pins package-runner entries (`npx`, `npm exec`,

package.json

@@ -131,6 +131,7 @@
     "concurrently": "^9.2.1",
     "cross-env": "^10.1.0",
     "electron": "44.2.0",
+    "expo-module-scripts": "^5.0.8",
     "get-port-cli": "^3.0.0",
     "js-yaml": "^4.1.1",
     "knip": "^5.82.1",

packages/expo-two-way-audio/package.json

@@ -33,7 +33,6 @@
   "devDependencies": {
     "@types/jest": "^29.5.14",
     "@types/react": "^18.0.25",
-    "expo-module-scripts": "^5.0.8",
     "expo-modules-core": "^2.0.4"
   },
   "peerDependencies": {

packages/expo-two-way-audio/tsconfig.json

@@ -6,7 +6,7 @@
     "module": "esnext",
     "moduleResolution": "bundler",
     "typeRoots": [
-      "./node_modules/expo-module-scripts/ts-declarations",
+      "../../node_modules/expo-module-scripts/ts-declarations",
       "./node_modules/@types",
       "../../node_modules/@types"
     ]