Fix release pipeline dependency blockers

[vinlim]

The Release workflow has failed on every tag since v1.0.4. v1.0.5, v1.0.6 and v1.0.7 are tagged and pushed, but no GitHub Release was ever created for them, so the Releases page still shows v1.0.4 as latest.

Two gates were failing.

postinstall → tsc -b (broke v1.0.6, v1.0.7)

eslint.config.ts(20,3): error TS2345:
  Type '17' is not assignable to type 'EcmaVersion'.

eslint 9.39.5 widened EcmaVersion to include 17; typescript-eslint 8.22.0's ConfigWithExtends still expects the narrower union, and eslint.config.ts spreads reactPlugin.configs.flat.recommended straight into ts.config(). Both were on carets, so the lockfile drifted into an incompatible pair. Bumped typescript-eslint to 8.67.0 and dropped the carets on both so they cannot drift apart again.

This never showed up locally because tsc -b is incremental — a stale tsconfig.tsbuildinfo skipped the rebuild. tsc -b --force reproduced it on a dev machine.

pnpm audit --prod --audit-level=high (broke v1.0.5)

Two high advisories in react-router, via pages/popup > react-router-dom:

• GHSA-chx6-hx7r-mcp5 — patched in >= 7.18.0
• GHSA-qwww-vcr4-c8h2 (RSC CSRF bypass) — patched in >= 7.18.2

Raised the react-router-dom floor to ^7.18.2.

Verification

Ran the full release job locally:

Step	Result
tsc -b --force	pass
pnpm audit --prod --audit-level=high	no known vulnerabilities
pnpm turbo ready	6/6
pnpm lint:check	0 errors (3 pre-existing warnings)
pnpm type-check	8/8
pnpm test	436 passed, 4 skipped
pnpm build	3/3, no source maps in dist
pnpm -F zipper zip	0.96 MB

Note this also unblocks the Test workflow, which has been red on main since the same dependency drift.

Once merged, the three missed releases still need backfilling — the workflow only fires on push: tags: v*, so the existing tags will not re-run on their own.