Two problems showed up in the same Renovate run.

The xterm packages arrived as three separate PRs (#277 addon-fit, #278
addon-unicode-graphemes, #280 xterm core). They ship from one repo on one
beta counter and each addon peers on the exact core beta it was built
against — addon-fit@0.12.0-beta.291 requires ^6.1.0-beta.291, which
6.1.0-beta.288 does not satisfy — so merging any one of them alone lands
an unsatisfied peer range and addons compiled against mismatched core
internals. Group them, as we already do for storybook, vite, and
react-router.

The previous commit disabled @xterm/addon-webgl to protect canopy's
fork-base pin, but that lockstep is a pair: the SDF tarball bundles core
internals, so @xterm/xterm@6.1.0-beta.288 is pinned to the same fork base
as @xterm/addon-webgl@0.20.0-beta.287, and nothing was guarding it.
#280 happened to leave canopy alone, but only by luck — a bump there
would have silently invalidated the UpstreamVsFork baseline, with the
tarball URL invisible to Renovate so nothing would flag it. Replace the
package-scoped rule with a canopy/package.json-scoped @xterm/** disable,
which covers both pins and lets lib and standalone keep tracking upstream.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>