chore(deps-dev): finish Biome 2, SDK Vitest 5, and Node 22 type upgrades
Includes the repaired #246 and #248 commits so their overlapping SDK lockfile edits are reconciled in one merge. Node types remain on 22.20.5, and the SDK runs Vitest 5.0.3 with two workers. Main has been merged into all three PR branches.
Migrates Biome from 1.9 to 2.5.15 so lint and commit hooks work with the new configuration schema and import organizer. Preserves tabs, 120-column formatting, existing exclusions, the recommended rule preset, and the explicit unused-import/variable and non-null assertion settings. Warnings now fail CI and hooks, preserving enforcement after severity changes in Biome 2.
Applies the new import/export ordering and formatting. Adds an accessible title to the banner SVG and removes an unused callback return in the SDK test helper. Narrow suppressions cover seven intentional Bash interpolation strings without changing test inputs. An AST comparison of the changed JavaScript/TypeScript confirmed no other logic changes and preserved side-effect import ordering.
Resolved the main merge conflicts while retaining all previously merged dependencies and the just-bash patch. pnpm lint:fix and type checking pass. A real warning fixture confirmed warnings fail the gate. Full repository/runtime verification passed before merge.
The event-loop monitor negative guard now waits for a real native histogram sample and a measured stall before flushing its logging window. Only the JavaScript interval is controlled; perf_hooks, Date, the busy loop, and timeouts remain real. The original measured-delay assertion and alert thresholds are preserved. Before the fix, isolated full verification failed with "expected 10 to be greater than or equal to 100"; the fixed test passed five consecutive focused runs. Full verification passed with this test synchronization fix.
Final validation: pnpm check, pnpm security:audit, and pnpm verify:architecture all passed sequentially on a fresh GitHub runner. Full proof and downloadable evidence. The validation branch (#255) differs only by its temporary workflow, which is excluded from this merge. Normal CI is also green.
Local verification attempts reported a distributed-lock timing failure, two 15-second worker-test timeouts, and a reader-latency assertion failure. The corresponding complete unchanged suites passed on the fresh runner. The audit passes the high-severity gate with the existing moderate sprintf-js advisory through the unchanged just-bash dependency.
Merge with a merge commit to preserve the repaired #246 and #248 heads; all three branches contain current main. No package versions or CHANGELOG.md were bumped.