[shayc]

Upgrades the development toolchain to the reviewed stable releases and refreshes a vulnerable transitive dependency. Node types remain on the Node 22 line to match the minimum supported runtime.

The upgrades are split into eight commits, with Oxlint/tsgolint and Vitest/coverage kept together, followed by a separate shell-quote security fix:

Dependency	Before	After
@changesets/cli	3.0.1	3.0.3
@types/node	22.20.1	22.20.5
publint	0.3.24	0.3.25
oxlint	1.80.0	1.87.0
oxlint-tsgolint	7.0.2001	7.0.2003
zod	4.5.4	4.6.5
tsdown	0.22.14	0.23.0
vitest and @vitest/coverage-v8	4.1.11	5.0.3
oxfmt	0.65.0	0.72.0
shell-quote (transitive)	1.10.0	1.12.0

Adds Vitest 5's .vitest artifact directory to .gitignore and synchronizes the lockfile root version with the existing package version. TypeScript remains at 7.0.2.

An additional commit regenerates the lockfile, refreshing 14 transitive dependencies while preserving all direct dependency versions. This includes the coverage remapper, Babel parser, Changesets prompt/editor dependencies, and build configuration helpers.

Validation after a clean npm ci on Node 26.7.0:

• Lint, formatting, typecheck, build, and strict Publint checks pass.
• All 164 tests pass; coverage remains 99.53% statements, 99.1% branches, 100% functions, and 99.52% lines.
• npm audit reports zero vulnerabilities.
• Oxfmt requires no source or documentation reformatting.
• tsdown emits identical JavaScript; declaration bodies and all 57 public exports are preserved, with only export placement changing.

CI also passes on Node 22, 24, and 26 for the refreshed lockfile. The existing build warning about TypeScript 7's experimental API remains.