chore: update all dependencies, pnpm 12, and GitHub Actions

[SynthLuvr]

Summary

Updates every dependency to its latest version — npm devDependencies, the pinned package manager, GitHub Actions refs, and the pandoc pin in CI.

npm devDependencies

Package	Before	After
ts-canon	^0.1.0	^0.1.5
vitest	^4.1.11	^5.0.0
@vitest/coverage-v8	^4.1.11	^5.0.0
@types/node	^26.2.0	^26.4.1
typescript	^7.0.2	^7.0.2 (already latest)

Toolchain

• pnpm 11.22.0 → 12.3.4 (packageManager). pnpm 12 defaults minimumReleaseAge to 1440 minutes (24 h) — its breaking changes (git-dependency resolution, unrecognized workspace settings) don't affect this repo.
• GitHub Actions (via pnpm update --include-github-actions): pnpm/action-setup v6.0.10 → v6.1.0 (the release that adds pnpm 12 support). actions/checkout v7.0.1 and actions/setup-node v7.0.0 were already latest; all three uses: refs are now pinned to full commit SHAs (pnpm 12 behavior). SHAs verified against the corresponding release tags.
• pandoc 3.10.2 → 3.11 in CI (matches ts-canon's own CI). Markdown verified byte-identical under pandoc 3.11 — pnpm format produced zero drift.

ts-canon 0.1.5 release age — resolved

ts-canon 0.1.5 was initially under pnpm 12's default 24-hour minimumReleaseAge supply-chain policy, so this PR temporarily carried a minimumReleaseAgeExclude entry to allow pnpm install --frozen-lockfile in CI. ts-canon 0.1.5 is now past the 24-hour window, and the exclusion has been removed (31b6523) — the lockfile passes the policy check with defaults only.

Note: ts-canon 0.1.6 has since been published (a migrate CLI fix plus transitive refresh; no impact on this template). The ^0.1.5 range picks it up in a follow-up update once it ages past the policy — mergeable after 2026-09-08 05:07 UTC.

Verification

• pnpm build, pnpm lint, pnpm test all pass (vitest 5.0.0, 3/3 tests, 100% coverage)
• pnpm install --frozen-lockfile passes pnpm 12's supply-chain policy check without any exclusions
• ts-canon doctor reports the full toolchain healthy
• Vitest 5's breaking changes (removed entry points, sequential option, etc.) don't touch this template's config or tests