chore: release 5.2.0

[finalerock44]

Promote from dev to stable:

• feat(cloud): upload-level device matrix (#1105) — one dcd cloud upload carries N device configs via repeatable --ios-device-matrix <device>:<version> / --android-device-matrix <device>:<apiLevel>[:play], fanning out into one result row per (flow × config). Each flag names exactly one validated cell; there is no cross-product. Sequential flows form N independent depends_on chains, one per device. Adds a pre-submit cell-count + cost preview and a device object on each --json tests[] entry.
• fix(cloud): refuse a device matrix on an API that cannot honour it — an older API silently strips the unknown field and runs one device, exiting 0; the CLI now fails loudly instead of under-testing in silence.
• test: run the integration suite via execFile argv rather than a shell, clearing the whole js/shell-command-injection-from-environment class.

REQUIRES the dcd API carrying #1105 to be on production first. Without it the matrix flags cannot be honoured (the CLI refuses, by design).

Carries only the source delta — package.json version, CHANGELOG.md and the release-please manifests stay as release-please left them on production.

Release-As: 5.2.0

What & why

Type of change

• fix — bug fix
• feat — new feature
• perf — performance improvement
• refactor — code change that's neither a fix nor a feature
• docs — documentation only
• chore / ci / build / test — tooling, no user-facing change
• Breaking change (title has ! or PR notes a BREAKING CHANGE:)

Checklist

• PR title follows the Conventional Commits format (see comment above)
• pnpm lint passes
• pnpm typecheck passes
• pnpm build passes
• I have not bumped the version or edited CHANGELOG.md (release-please handles this)
• I have signed the CLA (the bot will prompt on first contribution)
• Docs / README.md / STYLE_GUIDE.md updated if behaviour or output changed

How to test

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}