build: adopt supported toolchain ceiling

[BrickerP]

Summary

• move from Vite 6.4.3 to the latest supported Vite 7.3.6 while retaining exact Node 22.23.1
• adopt stable TypeScript 6.0.3 and keep @types/node aligned with runtime major 22
• encode Dependabot gates for the proven Vite 8 seam regression, Node type majors, and the separately gated TypeScript 7 migration
• make the CI contract reject cross-entry Dependabot-rule false positives

Evidence

• clean-room review: APPROVE, P0/P1/P2/P3 = 0
• local static, CI-contract, telemetry, geometry, typecheck, build, bundle budget, and dist integrity all pass
• Vite 7 and TypeScript 6 individual Dependabot candidates passed Linux seam and macOS Chrome seam; this combined PR must pass the full browser matrix again
• package-lock v3 regenerates byte-identically; npm audit reports 0 vulnerabilities

Compatibility basis

• Vite 7 requires Node 20.19+ or 22.12+; this repo pins 22.23.1
• TypeScript 6 is the stable transition release; TypeScript 7 remains separately gated
• @types/node stays on major 22 to describe the deployed Node 22 API surface

Pages deployment remains main-only; PR checks consume the immutable built artifact without publishing it.