Validation only: repair the three remaining dependency PRs

Draft
HA
12d ago
+443-516

Validation only; do not merge.

This branch contains exactly the combined repairs in #252 (including #246 and #248) plus one temporary workflow. The workflow runs pnpm check, pnpm security:audit, and pnpm verify:architecture sequentially on a fresh GitHub-hosted runner. No tests, assertions, or timeouts are relaxed. The temporary workflow will not enter main; this draft PR will be closed after its evidence is collected.

Summary by cubic

Combines the repairs for the three open dependency PRs (@types/node, Vitest, Biome) and adds a temporary workflow to validate them on a fresh runner. This branch is proof-only and will not be merged; the workflow is dropped and the PR closed once the evidence is collected.

Dependency repairs

  • @types/node in clients/typescript stays on Node 22 (^22.20.5) rather than accepting the Dependabot major bump to Node 26; Dependabot now ignores major updates for that package.
  • Vitest in clients/typescript is upgraded from 3.2.6 to 5.0.3, with tests reflowed for the new option API, maxWorkers: 2 added to the Vitest config, and the event-loop stall test reworked to synchronize a real stall with native perf_hooks sampling via fake timers and expect.poll.
  • Biome is upgraded from 1.9 to 2.5.15, with the config migrated to the 2.x schema (assist actions, preset: recommended, includes), imports sorted across the repo, and --error-on-warnings added to lint scripts.

Validation workflow

  • The temporary .github/workflows/dependency-validation.yml runs pnpm check, pnpm security:audit, and pnpm verify:architecture sequentially on a fresh GitHub-hosted runner with no relaxed tests, assertions, or timeouts.