Migrate from @sentry/cli to the new getsentry/cli

[antonis]

Description

Migrate the SDK's build-time tooling from the legacy @sentry/cli (currently 3.8.0) to the new getsentry/cli.

Motivation and Context

Today @sentry/react-native depends on @sentry/cli v3 directly, while @sentry/bundler-plugins still resolves @sentry/cli v2. Because these are two incompatible majors, npm/yarn cannot dedupe them and users get the CLI binary installed twice (once per major).

With v11 of the SDKs — and therefore the bundler plugin — we move to the new getsentry/cli, skipping v3 of the old CLI on the plugin side. Aligning the React Native SDK onto the same new CLI removes the duplicate binary and keeps the RN SDK and bundler plugin on a single, shared CLI.

Reported by a user hitting the double-install.

Scope / current CLI touchpoints

The CLI is invoked from build-time scripts, not the JS runtime:

• scripts/update-cli.sh — pins the CLI version (packages/core, root, packages/expo-upload-sourcemaps).
• packages/core/scripts/sentry-xcode.sh — react-native xcode (source maps upload).
• packages/core/scripts/sentry-xcode-debug-files.sh — debug-files upload (dSYM, --include-sources).
• packages/core/sentry.gradle.kts — resolves/invokes the CLI for Android.
• @sentry/expo-upload-sourcemaps — bundled CLI for Expo.

Migration risks

Overall: medium-low. Distribution is one platform binary per npm install.

• Binary distribution — the new CLI, like the old one, installs one platform binary through npm. No change in install footprint.
• debug-files upload — supports dSYM and --include-sources. ✅ parity.
• react-native xcode / react-native gradle — both exist in the new CLI and mirror the legacy workflows. ✅ parity.
• ⚠️ Xcode wrapper build-script argument (needs code change + testing) — the existing wrapper passes the RN build-script path as a trailing positional:

  # packages/core/scripts/sentry-xcode.sh:64
  REACT_NATIVE_XCODE_WITH_SENTRY="\"$SENTRY_CLI_EXECUTABLE\" react-native xcode $ARGS \"$REACT_NATIVE_XCODE\""

  The new command expects the build script via --build-script; positionals are forwarded to the script instead. The wrapper must be adjusted and tested (default path + custom $1 override, spaces in paths — see Expo plugin: iOS build phases break when the project path contains a space (unquoted command substitutions) #6583).

Acceptance criteria

• RN SDK, @sentry/expo-upload-sourcemaps, and the bundler plugin resolve to a single CLI — no duplicate binary install.
• iOS source maps upload works (default and custom build-script path, paths with spaces).
• iOS debug-files (dSYM) upload works, including --include-sources.
• Android (sentry.gradle.kts) upload works on both architectures.
• Expo sourcemaps upload works.
• SENTRY_DISABLE_AUTO_UPLOAD / SENTRY_ALLOW_FAILURE behavior preserved.
• scripts/update-cli.sh / version-pinning updated for the new CLI.

Next steps

Target: v11 (align with the bundler plugin's move to the new CLI).

[linear-code]

RN-793