chore(uplift): typescript 6.0.3 exact + scaffold_tag (p34/p38 movement)

[Jesssullivan]

What

• Pin typescript to exact 6.0.3 — was floating "next" (worse than a caret), which the lockfile had resolved to nightly 6.0.0-dev.20260416.
• Regenerate pnpm-lock.yaml via pnpm install --lockfile-only: diff is typescript-only (resolution + peer-dep suffix rewrites), no unrelated dependency movement.
• Stamp scaffold_tag: v0.1.0 into tinyland.repo.json per the site.scaffold manifest schema. Honest lineage: this retrofit-sibling conforms to the pre-uplift v0.1.0 scaffold baseline (no v0.2.0 surfaces present), so it is NOT stamped v0.2.0.
• ignoreDeprecations NOT added: tsconfig.json carries no TS6-deprecated options (bundler moduleResolution, no target/downlevelIteration/import-assert flags), confirmed by a clean check run.

Proof (in-clone, pnpm 10.13.1 via corepack)

• pnpm install green
• pnpm run check (svelte-kit sync + svelte-check): 0 errors (4 pre-existing warnings), tsc reports Version 6.0.3
• pnpm run lint (prettier + eslint): green

Part of the uplift movement (ledger item 18, prompts 34/38 spoke-half). Do not merge without green CI.

[Jesssullivan]

Held, not by this change (uplift movement, 2026-07-03). This PR is a trivial TypeScript next→6.0.3 pin + scaffold_tag stamp; every check is green except the required browser-rbe-proof, which is BLOCKED-status only.

Root cause (verified): browser-rbe-proof.yml was added to this repo's default branch today (09:28Z, another lane), and its cross-repo GF-REAPI dispatch fails with Could not resolve dispatched GloriousFlywheel proof run — even on an idle REAPI queue (I re-dispatched at ~10:20Z with 0 in-flight proofs; still failed). So it's not the earlier MI-proof concurrency collision; the new required check has never passed (0/N green since it landed).

Leaving this PR open for whoever owns browser-rbe-proof.yml to make the check functional (likely the GF_REAPI_PROOF_DISPATCH_TOKEN permission or the dispatch payload). The ts-pin itself is merge-ready the instant the check works — no rebase needed.

[Jesssullivan]

Codex correction: the browser-rbe-proof blocker was not a shared lease/concurrency failure. The consumer dispatch resolved GF run 28654553930; GF rejected the proof before Bazel execution because the requested digest was stale:

ERROR: requested digest differs from at least one live gf-rbe deployment.

The darkmap repo variable GF_REAPI_CELL_IMAGE_DIGEST was still sha256:9db80cc9...; live gf-rbe is sha256:58b456281c0862da0153e8691cd77b5de43052dc25d37836329c48baf05af135. I updated the repo variable to the live digest and reran the failed workflow.

[Jesssullivan]

Update after rerun with the live GF cell digest:

• The stale GF_REAPI_CELL_IMAGE_DIGEST blocker is fixed; the GF proof now reaches real remote execution.
• GF run 28671802456 produced countable RBE evidence: 1786 processes: 147 remote cache hit, 1033 internal, 606 remote, current worker digest sha256:58b456281c0862da0153e8691cd77b5de43052dc25d37836329c48baf05af135.
• 13/14 browser smoke targets passed remotely.
• The remaining failure is //:playwright_point_readout_smoke, crashing Chromium before scenario assertions at browserContext.newPage: Target page, context or browser has been closed, with GL/font setup errors in the worker browser launch.

I reran the failed job once more to distinguish a one-off remote Chromium launch flake from a deterministic point-readout/browser-envelope issue. TIN-2402 now tracks the corrected state.

[Jesssullivan]

Status update from the rerun:

• Fixed stale GF_REAPI_CELL_IMAGE_DIGEST repo var to the live GF cell digest.
• Patched the browser-RBE smoke launcher to use the repo's working Chromium shape: --use-gl=angle + --use-angle=swiftshader.
• GF proof run 28673060432 passed on the patched branch, so the browser-RBE latch itself is now proven green.
• Follow-up commit 54cbd1c is formatting-only for the touched script after normal CI caught Prettier.

Current state: waiting for the formatted-head checks to drain; no force-merge.

[Jesssullivan]

Follow-up after the formatted-head proof:

GF run 28673493509 proved the Chromium launch fix moved the failure forward: 13/14 browser smokes passed remotely with 721 remote cache hit and 32 remote actions. The old point-readout browser/context crash is gone.

The remaining failure was a real darkmap smoke race:

//:playwright_click_budget_smoke FAILED
click-budget: Air answer (AQI) not reachable in ≤1 click: "—"

Root cause: Air keeps the same one-click budget, but the Air lens nudges the smog/OpenAQ data path on asynchronously. The test was waiting only for .aqi-value attachment, then reading the placeholder before the numeric AQI arrived.

Pushed 672bbbf: wait for .aqi-value to become numeric without adding another click. Local prettier --check, node --check, and git diff --check pass. CI is rerunning.