ci: run the test suite against React 19 (#789)

CI type-checks React 19 but has never executed a test against it: the
react matrix exists only on the type-check job, and the test job runs the
lockfile's React 18. This adds react 18/19 as a test-job dimension, so the
suite runs on 19 before any src/ change lands for the React 19 foundation.

@testing-library/react moves 14 -> 16, with @testing-library/dom as a new
direct dependency. This is forced rather than opportunistic: RTL 14 declares
React ^18 only, so the 19 leg cannot run without it. The lockfile shrinks
because RTL 14's nested @testing-library/dom collapses into the top-level
install; no packages are added.

The React 18 legs keep their existing job names, so main's required status
checks keep matching and no admin change is needed. Only the 19 legs get a
suffix, which also means a React 19 failure does not gate a merge while 19
support is still being built.

A guard step after the artifact overlay asserts the installed React matches
the matrix leg. Without it the dimension is decorative: the only behavioural
difference between the legs is one skipped test, so a 19 leg that silently
ran 18 would pass.

That one test is skipped on 19 only, tracked in #793: in suspense mode,
swapping the observable resumes with the previous observable's value on
19.2.8 while passing on 18.2.0, deterministic across three runs each.

Emulator jobs go from two to four, which doubles per-PR exposure to the
#776 flake.

Refs #789

Author: tyler-reitz

.github/workflows/test.yaml

@@ -52,8 +52,14 @@ jobs:
     strategy:
       matrix:
         node: ["22", "24"]
+        react: ["18", "19"]
       fail-fast: false
-    name: Test Node.js ${{ matrix.node }} (Ubuntu)
+    # The React 18 legs keep the original job names on purpose: `main`'s required
+    # status checks reference them, so renaming would block every PR there until
+    # an admin updated the contexts. Only the non-18 legs get a suffix, which
+    # also means a React 19 failure does not gate a merge while 19 support is
+    # still being built. Add the contexts when we want it to.
+    name: Test Node.js ${{ matrix.node }}${{ matrix.react != '18' && format(' / React {0}', matrix.react) || '' }} (Ubuntu)
     steps:
       - name: Checkout
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -67,6 +73,14 @@ jobs:
           cache: 'npm'
       - name: Install deps
         run: npm ci
+      # Only the 19 leg swaps the runtime; the 18 leg runs the lockfile's React
+      # as-is. --no-save keeps the lockfile out of the diff. Note this differs
+      # from the type-check job, which installs on both legs and also installs
+      # the types, so the 18 legs of the two jobs cover different React 18
+      # patch versions.
+      - name: Install React ${{ matrix.react }}
+        if: matrix.react == '19'
+        run: npm install --no-save react@${{ matrix.react }} react-dom@${{ matrix.react }}
       - name: Setup Java
         uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
@@ -86,6 +100,23 @@ jobs:
         run: |
           chmod +x reactfire-${{ github.run_id }}/unpack.sh
           ./reactfire-${{ github.run_id }}/unpack.sh
+      # Without this the matrix is decorative: the only behavioural difference
+      # between the legs is one skipped test, so a 19 leg silently running 18
+      # would pass. Runs after the artifact overlay so it covers everything
+      # that could disturb the install.
+      - name: Confirm React ${{ matrix.react }} is what will run
+        env:
+          WANT_REACT: ${{ matrix.react }}
+        run: |
+          node -e '
+            const want = process.env.WANT_REACT;
+            const got = require("react/package.json").version;
+            if (!got.startsWith(want + ".")) {
+              console.error(`expected React ${want}, got ${got}`);
+              process.exit(1);
+            }
+            console.log(`React ${got} confirmed for matrix leg ${want}`);
+          '
       - name: Run tests
         run: npm run test
   type-check: