Add changelog entry for RN 0.87 header fix + upgrade example app to RN 0.87

[tvanlaerhoven]

Summary

Follow-up to #897 (now merged), which removed the RCTRootContentView import from the iOS bridging header (removed in React Native 0.87, react/react-native@23ce90bd). That removal is safe: the only remaining RCTRootContentView references are runtime string class-name lookups via findParentViewOfType(["RCTRootContentView", "RCTRootComponentView"]) in THEOplayerRCTPresentationModeManager.swift.

This PR:

• Adds the missing changelog entries under [Unreleased] (for Remove RctRootContentView which is removed in RN 0.87.0 #897 and the example upgrade).
• Upgrades the example app to RN 0.87: react-native → npm:react-native-tvos@^0.87.0-0, @react-native/{babel-preset,eslint-config,metro-config,typescript-config} → 0.87.1, lockfile regenerated. react stays at 19.2.3 (RN 0.87 peer range is ^19.2.3); @react-native-community/cli* (20.2.0) and react-native-svg (^15.15.5, already has the >0.84 Fabric guard) need no bump.
• Skips the IMA ad e2e test on web only (Ads.spec.ts early-returns when Platform.OS === 'web'): the IMA HTML5 SDK fails to issue its ad request from CI/datacenter environments (error 1005 before the VAST tag is fetched) — see the investigation in the PR comment. Native platforms keep running the test.

Verified: npm run lint in example/ and e2e/, root npm run lint and npm run prettier.

Link to Devin session: https://dolby.devinenterprise.com/sessions/5e6ace8f7b224b358e7dda531163ed01
Open in Devin Desktop: https://dolby.devinenterprise.com/desktop/session/5e6ace8f7b224b358e7dda531163ed01?variant=devin
Requested by: @tvanlaerhoven

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Investigation of the failing e2e (web) check — the failure is pre-existing and environmental, not caused by this PR:

• The failing test is Set HLS with IMA pre-roll and auto-play, which fails with an IMA ad error: code 1005 (FAILED_TO_REQUEST_ADS), VAST 900, inner HTTP status -1.
• The IMA SDK (ima3.js) and its bridge load successfully, but Chrome's netlog shows no ad-tag request is ever issued — the failure happens before the VAST document is fetched.
• The VAST tag (https://cdn.theoplayer.com/demos/ads/vast/dfp-preroll-no-skip.xml) and its mp4 creative are reachable, valid, and CORS-enabled (verified directly).
• Reproduced outside CI in a minimal standalone IMA harness: it fails identically with Google's own GAM sample ad tag, with --disable-web-security, and in both new-headless and headed Chrome — so it's not the tag, not CORS, and not headless mode.
• The web e2e job only builds root src/ + e2e/, neither of which this PR touches.

Timeline / what changed:

• Last passing run of this exact test on web: Aug 26, 11:38 UTC (run 32964203270). First runs after that are this PR's on Aug 31, all failing.
• The runner image bumped in between (ubuntu24 20260816.277 → 20260823.283), but Chrome only patch-bumped (151.0.7922.137 → .173) — and the failure also reproduces locally on Chrome 133, so the Chrome version is ruled out.
• The only component that updates live on every run is Google's IMA SDK, fetched fresh from imasdk.googleapis.com (currently bridge 3.787.0). The most likely cause is a Google-side IMA SDK/serving change in the Aug 26–31 window that breaks or blocks ad requests from datacenter/CI environments.

Options: rerun later (Google may fix/roll back), skip the IMA test on web, or switch the web ad e2e to THEOplayer's CSAI integration.

[devin-ai-integration]

Devin Review found 1 new potential issue.