chore(deps): replace vulnerable development toolchain

[bdsqqq]

the development toolchain was pinned to node 16-era packages. a clean pnpm audit reported 56 findings: 1 critical, 25 high, 25 moderate, and 5 low. the three open dependabot updates each patch one 2023-era transitive version, but leave newer advisories in the same dependency graph.

this replaces that graph with pnpm 10, eslint 9 flat config, typescript 5.9, and tsdown. tests now use node's built-in runner, removing the vulnerable vitest/vite/esbuild chain. ci runs on node 22 and validates audit, lint, typecheck, tests, and build.

validation from empty node_modules and dist under node 22.20.0 and pnpm 10.34.5:

• pnpm install --frozen-lockfile
• pnpm audit --json: 0 vulnerabilities
• pnpm run lint
• pnpm run typecheck
• pnpm run test: 3 passed
• pnpm run build: cjs, esm, and declaration outputs
• publint: passed
• cjs and esm runtime smoke checks: passed
• npm pack --dry-run: expected seven files

prepared by bdsqqq with amp.