chore: release 5.3.0

[finalerock44]

Promote from dev to stable:

• feat: client-side envelope encryption of app binaries, flow zips and env vars (feat: client-side envelope encryption of binaries, flow zips & env vars #94, feat(upload): dedup encrypted binaries on the plaintext hash #101) — opt-in via --encrypt / DCD_ENCRYPT_BINARIES=1 and off by default, so uploads stay byte-identical unless asked for. Per-upload DEK, chunked AES-256-GCM container, X25519 sealed-box DEK wrap; encrypted binaries dedup on the plaintext hash so re-uploads still hit the cache.
• feat(artifacts): prefer server-assembled bundle delivery for downloads (feat(artifacts): prefer server-assembled bundle delivery for downloads #93) — falls back to the inline endpoint on 501, so it degrades cleanly against an API that has not shipped bundles.
• feat(device): add Android API level 37 (Android 17) (feat(device): add Android API level 37 (Android 17) #107) — the flag enum accepts 37, but the device/API-level pair is validated against the compatibility matrix the target API serves, and production still tops out at 36, so 37 is refused client-side until the platform gate flips.
• refactor(cloud): remove the enterprise-only --mitmHost / --mitmPath flags (refactor(cloud): remove mitmproxy flags #102). The submitted config payload for runs that never passed them is byte-identical.
• fix(deps) / deps: clear every outstanding pnpm audit advisory (fix(deps): resolve pnpm audit failures in transitive dependencies #89, deps: bump the minor-and-patch group across 1 directory with 7 updates #92, deps: patch js-yaml and brace-expansion DoS advisories #95, deps: bump the minor-and-patch group across 1 directory with 5 updates #100, fix(deps): resolve three new transitive security advisories #106), bump chalk 5 -> 6, and regenerate the schema types from the current API swagger (chore: regenerate schema types from the current API swagger #105).

No platform prerequisite this time: the envelope decrypt half (dcd api + simulators) is already on production with both env KEK public keys pinned, bundle delivery has a 501 fallback, and API 37 is gated server-side.

Carries only the source delta — package.json version, CHANGELOG.md and the release-please manifests stay as release-please left them on production.

Release-As: 5.3.0

What & why

Type of change

• fix — bug fix
• feat — new feature
• perf — performance improvement
• refactor — code change that's neither a fix nor a feature
• docs — documentation only
• chore / ci / build / test — tooling, no user-facing change
• Breaking change (title has ! or PR notes a BREAKING CHANGE:)

Checklist

• PR title follows the Conventional Commits format (see comment above)
• pnpm lint passes
• pnpm typecheck passes
• pnpm build passes
• I have not bumped the version or edited CHANGELOG.md (release-please handles this)
• I have signed the CLA (the bot will prompt on first contribution)
• Docs / README.md / STYLE_GUIDE.md updated if behaviour or output changed

How to test

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.