chore(deps): coordinate ten validated dependency updates
This consolidates ten dependency updates into one validated merge so shared workflow and lockfile edits land together. Original PR commits are preserved; merge this PR with a merge commit to retain their ancestry.
Includes #240 (release action), #241 (setup-python), #242 (pnpm setup), #243 (checkout), #244 (artifact uploads), #245 (Ruff), #247 (Changesets changelog), #249 (Changesets CLI), #250 (tsx), and the original #251 (jose).
Resolves adjacent checkout/pnpm workflow edits and regenerates the root lockfile with pnpm 10.30.3 while retaining the patched just-bash dependency. Adds a patch changeset for jose validation fixes. Package versions and CHANGELOG.md are unchanged.
The Node 26 types (#246), SDK Vitest 5 (#248), and Biome 2 (#252) updates are excluded. #246 conflicts with the Node 22 target and omits its lockfile; #248 omits its lockfile; #252 fails lint because its Biome configuration was not migrated.
Validation passed on a fresh GitHub-hosted runner: pnpm check, pnpm security:audit, and pnpm verify:architecture ran sequentially, with no assertions or timeouts changed. Full proof and downloadable verification evidence. The temporary validation branch (#254) differs from this PR only by its additional workflow; that workflow is excluded from this merge.
The expanded profile includes the standard disposable PostgreSQL/Redis, HTTP/MCP contracts, integration suite, live TypeScript/Python SDKs, worker failures, stream finalization, input budgets, and tenant proofs. The normal PR CI is also green. A separate Changesets 3 release fixture passed patch versioning, custom changelog generation with GitHub PR attribution/hash stripping, and changeset consumption. Actions upgrades were checked against upstream release notes and exercised on GitHub-hosted ubuntu-latest runners.
Local pnpm check and pnpm verify:local attempts reported timing-sensitive admission/event-loop and worker startup/latency failures on the busy shared host. The affected unit files passed five consecutive focused runs on both the baseline and updated branches. The fresh runner passed the full unchanged suites; the cause of the local failures has not been conclusively established.
The security audit passes the repository high-severity gate, with one existing moderate advisory in sprintf-js through the unchanged just-bash dependency. No dependency, patch, or security gate was removed.