build(deps): migrate frontend to Grafana 13.x

[alexinthesky]

Summary

Migrates the frontend from Grafana 12.x to 13.x dependencies. This is a deliberate housekeeping upgrade (not urgent - no v13 feature is currently blocking us), done to stop future @grafana/*@latest compatibility drift and to close the gap with the dev environment, which already defaults to a Grafana 13.0.1 server.

• @grafana/data, @grafana/ui, @grafana/runtime, @grafana/schema, @grafana/i18n → ^13.1.1
• @grafana/llm → ^1.0.9 (peer-capped at @grafana/data/runtime ^12; added an overrides entry so install succeeds - verified functionally fine)
• @grafana/scenes → ^8.13.3 (required, not optional: 6.42.3's PanelBuilders statically imports a @grafana/schema datagrid export removed in v13, hard build failure otherwise)
• plugin.json grafanaDependency floor bumped >=12.3.0 → >=13.0.0, since we have only built/tested against the 13.1.1 surface
• .github/workflows/is-compatible.yml targets pinned to the validated 13.1.1 baseline

React stays on 18. I initially assumed a React 19 bump was needed alongside this, but verified directly against grafana/grafana's own package.json (tags v13.0.1, v13.0.4, v13.1.0, v13.1.1, and main) that Grafana 13 still ships React 18.3.1, and @grafana/ui@13.1.1's peer dependencies hard-require react/react-dom ^18.0.0 (forcing 19 breaks npm install). Grafana's own 12.x→13.x migration guide explicitly says not to force a different React version - plugins should align to the host's runtime. So no React 19 changes here.

Removed an obsolete workaround: the @grafana/scenes deep-import webpack alias and its accompanying type shim (src/grafanaScenes.ts, src/types/grafanaScenesDeep.d.ts) existed to route around a jsx-runtime bundling leak in scenes' old barrel file. v8.13.3's dist/esm no longer references react/jsx-runtime and its package.json exports field is now fully restrictive (deep imports aren't even possible anymore), so the shim was both obsolete and incompatible with the new file layout.

Validator scan tightened: narrowed scripts/validate-react19.js's artifact scan to compiled .js only (excluding .js.map, whose sourcesContent embeds dependencies' pre-bundling source and produced a false positive from @floating-ui/react's jsx-runtime import - confirmed the compiled .js never contains that string). Allowlisted the one remaining @grafana/plugin-validator react-detect finding on the same package, per Grafana's migration docs, which lists this as a common false positive once the existing jsx-runtime webpack alias is applied. Documented as a third expected-benign npm run validate finding in CLAUDE.md.

Test plan

• npm run typecheck - clean
• npm run lint - 0 errors, 9 warnings (pre-existing, confirmed identical on base branch)
• npm run build - frontend + backend both succeed
• npm run test:ci - 491/491 passing, 34 suites
• npm run validate - exit 0; only expected findings (unsigned plugin, sponsor-link recommendation, documented floating-ui/react false positive, pre-existing "Go SDK older than 2 months")
• go test ./pkg/... - all packages pass
• Smoke-tested against a live Grafana 13.0.1 dev container: health endpoint, plugin health, module.js, config/app page routes, and backend routes (mcp/servers, prompt-defaults, sessions) all 200, clean container logs
• No in-browser console/visual check was possible in the session that built this (no browser tool available) - worth a manual spot-check before merging

🤖 Generated with Claude Code

---

Note

High Risk
Major Grafana/scenes upgrade changes the entire UI dependency surface and minimum host version; regressions in plugin loading, scenes panels, or LLM integration are possible until manual browser QA completes.

Overview
Frontend baseline moves from Grafana 12.4.x to 13.1.1, with @grafana/scenes jumping to 8.13.3 so builds stay compatible with the v13 @grafana/schema surface. @grafana/llm is bumped and package.json overrides align its peers with the new @grafana/data / @grafana/runtime versions. React stays on 18 (matches Grafana 13 host expectations).

Host and CI alignment: src/plugin.json grafanaDependency floor is raised to >=13.0.0, and .github/workflows/is-compatible.yml pins compatibility targets to the same 13.1.1 stack (plus @grafana/e2e-selectors and @grafana/experimental) instead of tracking @latest.

Validator / docs: CLAUDE.md documents an expected benign react-19-dep-jsxRuntimeImport finding from transitive @floating-ui/react, tied to existing webpack.config.ts jsx-runtime aliases and scripts/validate-react19.js (per the PR’s validator tightening). Obsolete @grafana/scenes deep-import webpack shims are removed where v8 no longer needs them.

^{Reviewed by Cursor Bugbot for commit 51f01f2. Bugbot is set up for automated code reviews on this repo. Configure here.}