Promote from dev to stable:

* feat: client-side envelope encryption of app binaries, flow zips and env vars
  (#94, #101) — opt-in via `--encrypt` / `DCD_ENCRYPT_BINARIES=1` and off by
  default, so uploads stay byte-identical unless asked for. Per-upload DEK,
  chunked AES-256-GCM container, X25519 sealed-box DEK wrap; encrypted binaries
  dedup on the plaintext hash so re-uploads still hit the cache.
* feat(artifacts): prefer server-assembled bundle delivery for downloads (#93) —
  falls back to the inline endpoint on 501, so it degrades cleanly against an
  API that has not shipped bundles.
* feat(device): add Android API level 37 (Android 17) (#107) — the flag enum
  accepts 37, but the device/API-level pair is validated against the
  compatibility matrix the *target* API serves, and production still tops out at
  36, so 37 is refused client-side until the platform gate flips.
* refactor(cloud): remove the enterprise-only --mitmHost / --mitmPath flags
  (#102). The submitted config payload for runs that never passed them is
  byte-identical.
* fix(deps) / deps: clear every outstanding pnpm audit advisory (#89, #92, #95,
  #100, #106), bump chalk 5 -> 6, and regenerate the schema types from the
  current API swagger (#105).

No platform prerequisite this time: the envelope decrypt half (dcd api +
simulators) is already on production with both env KEK public keys pinned,
bundle delivery has a 501 fallback, and API 37 is gated server-side.

Carries only the source delta — package.json version, CHANGELOG.md and the
release-please manifests stay as release-please left them on production.

Release-As: 5.3.0

Co-authored-by: dcd-cli-release-please[bot] <296541543+dcd-cli-release-please[bot]@users.noreply.github.com>