chore(deps): batch monthly dependency updates - #2984

Bundles the ten open Dependabot PRs into one branch, with two of them adjusted so they actually build.

• Straight bumps: @inquirer/core 11.2.1, @inquirer/type 4.0.7, jose 6.2.4, vitest 4.1.10, typebox 1.3.8, @types/node 25.9.5, @earendil-works/pi-coding-agent 0.82.1, actions/setup-node v7.
• ESLint 10 additionally needs typescript-eslint 8.65.0. chore(deps-dev): bump eslint from 9.39.5 to 10.8.0 #2974 bumped ESLint alone, which crashes at load: 8.47.0 caps its peer at ^9.0.0. ESLint 10 support landed in 8.60.0.
• TypeScript goes to 6.0.3, not the 7.0.2 chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 #2975 proposed. TS 7 is unusable here: typescript-eslint caps at <6.1.0 and hard-throws on TS 7, and rollup-plugin-dts (via tsup) caps at ^6.0 and crashes generating .d.ts. Both are upstream blockers with no local workaround. 6.0.3 is the highest version the toolchain supports.
• Extracted tsconfig.bundler.json for the profile sdk, tools-ai-sdk and pi each duplicated. Hoisting types: ["node"] into it also fixes a latent break: only sdk had it, so tools-ai-sdk would have failed its dts build the first time it referenced console in src/.
• ignoreDeprecations: "6.0" is required because tsup hardcodes baseUrl: compilerOptions.baseUrl || "." into its dts worker, which TS 6 reports as TS5101. The suppression is passed via dts.compilerOptions in each tsup config, so it is scoped to the dts worker only — no tsconfig carries it and every package typechecks deprecations honestly. Removing it reproduces TS5101; with it, dist output is byte-identical.
• Shared dev toolchain moved to a pnpm catalog. @types/node had drifted to three floors across six manifests.
• Dropped the bun Dependabot ecosystem. There is no bun lockfile here and installs use pnpm, so it edited package.json without pnpm-lock.yaml and every PR it opened failed pnpm install --frozen-lockfile (chore(deps-dev): bump @earendil-works/pi-coding-agent from 0.78.1 to 0.82.1 #2972, chore(deps-dev): bump eslint from 9.39.5 to 10.8.0 #2974, chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 #2975, chore(deps-dev): bump @types/node from 22.20.1 to 25.9.5 #2976).

Closes #2981, #2980, #2979, #2978, #2977, #2976, #2975, #2974, #2973, #2972

Verification

pnpm install --frozen-lockfile, lint:check, format:check, build, typecheck and test all pass. 340 tests, identical to master.

The Dependabot PRs' red checks were not all real: Dependabot has no access to CONTEXT7_API_KEY, so the sdk tests fail for every one of them regardless of content. Those tests pass here against the live API.

Extra checks, since a compiler major, a tsconfig refactor and a shipped prompt dependency are not covered by the suite:

• Built artifacts are byte-identical to master's across all 46 emitted files in cli, sdk, mcp and tools-ai-sdk — verified both after the TS 6 bump and again after the tsconfig refactor.
• pnpm pack confirms the catalog: protocol is rewritten to concrete ranges in the published tarball, and changesets shells out to pnpm publish when it detects pnpm, so the publish path is unaffected.
• Injecting a deprecated option into tsconfig.bundler.json is caught by pi's typecheck, confirming the shared config stays validated despite the suppression in the tsup packages.
• @inquirer/core drives selectOrInput, which has no tests. A throwaway harness exercising arrow navigation, custom text entry, backspace, and empty-input fallback passed identically on 11.1.1 and 11.2.1.