chore: update all dependencies

[SynthLuvr]

Summary

Updates every dependency to its latest version — npm devDependencies, the pinned package manager, and the toolchain transitives. GitHub Actions refs and the pandoc pin were verified against the latest releases and require no changes.

npm devDependencies

Package	Before	After
ts-canon	^0.1.5	^0.2.0
@types/node	^26.4.1	^26.6.2
vitest	^5.0.0	^5.0.1
@vitest/coverage-v8	^5.0.0	^5.0.1
typescript	^7.0.2	^7.0.2 (already latest)

Toolchain

• pnpm 12.3.4 → 12.5.1 (packageManager; also used locally to regenerate the lockfile). Lockfile format unchanged. Transitive refresh (re-resolved at PR-latest): biome 2.5.14, oxlint 1.83.0 (tsgolint 7.0.2002), jscpd 5.3.0, undici-types 8.9.0, vite 8.2.2 → 8.3.0, rolldown 1.2.9, magic-string 1.4.1, and the now-unreferenced tsx/esbuild trees dropped entirely (leftovers from ts-canon < 0.2.0's tsx dependency).
• GitHub Actions — verified against latest releases: actions/checkout@v7.0.1, actions/setup-node@v7.0.0, pnpm/action-setup@v6.1.0 are all current. pnpm/action-setup picks up pnpm 12.5.1 automatically from the packageManager field.
• pandoc 3.11 in CI — still the latest release (2026-08-29); no change.

ts-canon 0.2.0

Notable upstream changes: the CLI now runs on Node native type stripping (drops the tsx dependency), relative lint/format paths are honored, and a new no-unsafe-cast ast-grep rule applies — the template sources pass it cleanly.

minimumReleaseAgeExclude — resolved

ts-canon 0.2.0 was published 2026-09-20 19:00 UTC, inside pnpm 12's default 24-hour minimumReleaseAge supply-chain window, so this PR initially carried a minimumReleaseAgeExclude: [ts-canon@0.2.0] entry in pnpm-workspace.yaml (12e5bbc's parent). ts-canon 0.2.0 is now past the 24-hour window and the exclusion has been removed (12e5bbc) — pnpm-workspace.yaml is byte-identical to main, and the lockfile passes the policy check with defaults only.

Verification

All from a clean node_modules with pnpm 12.5.1:

• pnpm install --frozen-lockfile — passes (exit 0), including the supply-chain policy check with no exclusions
• pnpm build (tsc) — clean
• pnpm lint — exit 0: biome, oxlint (0 warnings / 0 errors), all ast-grep rules (incl. new no-unsafe-cast), pandoc check (2 files byte-identical), peer-deps, audit (no known vulnerabilities), jscpd (0 clones)
• pnpm test — 3/3 tests passed, 100% coverage