fix(core): inherit nested target capabilities

[aidenybai]

What changed

When React Doctor is invoked from a nested directory without its own package manifest, capability detection now reads the nearest enclosing package.json and resolves Browserslist from that package root.

Why

The discovered project already inherited React/framework metadata from its enclosing package, but target-blank protection was computed against the nested directory. That could silently disable the rule for old browser and Electron targets.

Regression review

• covers a nested Chrome 80 project requiring explicit noopener
• covers a nested Electron 0.36 project requiring noreferrer
• reuses the existing nearest-package helper; no new architecture or public API
• full test suite, lint, typecheck, formatting, JSON-report smoke test all pass
• React Doctor changed-scope scan: 100/100, no issues
• patch changeset included

This PR is independent and targets main.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1478

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1478

npm i https://pkg.pr.new/react-doctor@1478

commit: afd61af

[github-actions]

React Doctor skipped this pull request — it changed no React files.

_{Reviewed by React Doctor for commit afd61af.}

[github-actions]

Interactive terminal E2E

Recorded from the built CLI at afd61af in a real terminal. The fixture holds Git busy for three seconds, so Scanning... must appear immediately after project selection, then exercises the compact interactive report.

Download the GIF and MP4 artifact