Managed dependency version updates for extensions

[TyceHerrman]

Problem

Extension dependency version updates currently appear to rely largely on extension owners or contributors noticing outdated packages and opening manual pull requests. That makes routine maintenance inconsistent and can leave extensions on obsolete transitive dependency chains.

#29598 is a concrete example: updating Doorstopper's @raycast/utils also required a compatible @raycast/api update, a regenerated lockfile, and real extension build validation.

Proposal

Would Raycast maintainers support a managed model for routine extension dependency version updates?

At a high level, it should:

• Treat related Raycast packages such as @raycast/api and @raycast/utils as a compatible group when their peer requirements move together.
• Use a conservative cadence and churn controls, such as weekly checks, a cooldown, grouped pull requests, and a strict open-PR limit.
• Run a real clean install and Ray CLI build before proposing an update.
• Account for the restricted secrets available to dependency-update workflows and the repository's current RAYCAST_CLI_ACCESS_TOKEN-dependent validation.
• Keep security updates separate from routine version updates.