feat: add a collapsible Market pager with NativeList parity

[huhuanming]

Summary

• add a cross-platform CollapsiblePagerView with coordinated collapsible headers, sticky navigation, retained page trees, and per-page scroll restoration
• add production-style Market rows to NativeList, including token, stock, and perpetual layouts, source/status badges, long-press actions, skeleton loading, refresh, pagination, empty states, and errors
• add interactive Market row leading actions across iOS, Android, and Web so Stocks and Top Coins can preserve their favorite controls after NativeList migration
• add the mobile Market pager example with replay/live data adapters, filters, search, watchlists, assets, routing, and diagnostics
• align compact section indexes and Android drag reordering across iOS, Android, and Web
• update package metadata, internal peers, changelog, Yarn lockfile, and CocoaPods lock data for publishing

Review fixes

• keep Web NativeList scroll offsets logical when the collapsible pager adds header and sticky insets
• synchronize Android headers after restored or programmatic list scrolling and preserve React-owned dynamic padding
• guard delayed Android callbacks across detach/reattach cycles
• restore the last acknowledged iOS page after an interrupted detach without emitting a synthetic selection
• use supported iOS gesture cancellation APIs
• clamp fractional, invalid, and stale page selections and handle conditional or shrinking child sets
• keep Web pager transitions settling until completion, recover cancelled gestures, honor locale RTL, and forward View props
• map compact section-index touches to the labels actually rendered
• clear stale segmented prices, preserve open Android row actions during quote-only patches, and retain existing rows after refresh or pagination failures
• expose checked and disabled Market leading actions with accessibility labels, test IDs, recycled-cell reset coverage, and action dispatch on all three platforms
• declare NativeList's native logger and same-version OneKeyImage dependencies
• lazy-load the Market example and replay snapshot so unrelated native and Web routes avoid the heavy startup payload

Published package verification

• release commit: 9c64500201eb5cfd2c9fbf73122db535c76e98f0
• CI publication: package-publish run 34532390534 completed successfully
• registry verification: all 39 publishable packages report 3.0.117 as both package version and latest
• the published NativeList and Pager packages contain the former temporary patch behavior; app-monorepo consumes the published packages without patch-package overrides

Validation

• yarn install --immutable: passed
• NativeList Jest: 6 suites / 70 tests passed
• NativeList native/Web parity contracts: 39 / 39 passed
• NativeList TypeScript: passed
• NativeList ESLint: 0 errors; 21 existing warnings
• NativeList Bob prepare: passed
• Android NativeList compileDebugKotlin on macOS with JDK 17: passed
• app-monorepo consumer CocoaPods install on macOS: passed, 196 dependencies / 217 pods
• app-monorepo Market integration regression tests: 10 suites / 119 tests passed
• git diff --check: passed

Sources

• feat: migrate mobile market to native pager with resilient lists app-monorepo#13272: mobile Market pager and NativeList integration
• fix: improve Android native list reordering app-monorepo#13301: NativeList Android reorder fixes

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​jsdom@​26.1.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm data-urls is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: native-views/react-native-native-list/package.json → npm/jsdom@26.1.0 → npm/data-urls@5.0.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/data-urls@5.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm rrweb-cssom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: native-views/react-native-native-list/package.json → npm/jsdom@26.1.0 → npm/rrweb-cssom@0.8.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rrweb-cssom@0.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[originalix]

基于当前 head 9c645002 的静态审查，以下三个问题建议修复。