Upgrade every dependency: Electron 44 (macOS 13+), TypeScript 7, oxlint in place of ESLint

[popen2]

Brings every dependency to its current release, including the majors that needed
breaking changes taken, and closes the one open advisory in the tree.

⚠️ This raises the macOS floor to 13 (Ventura)

Electron 44 drops macOS 12, and Frost updates itself in place without checking
the OS version — a Monterey machine would update into a build that will not
launch. README.md and docs/docs/platforms.html now say so, but this is the
part worth a decision rather than a skim.

Nothing in src/ used the APIs Electron 44 removed (renderer clipboard,
app.isUnityRunning, setProgressBar/setBadgeCount, net.request, the
select-client-certificate signature), and the build matrix was already 64-bit
only, so the 32-bit Windows and armv7l removals are no-ops here. The OS floor is
the whole of the breaking change.

Why the linter changed

TypeScript 7's package exports version and versionMajorMinor from its main
entry and nothing else — the TS 6 compiler API moved behind
typescript/unstable/* in a different shape. typescript-eslint reads
versionMajorMinor, sees 7, and throws rather than crashing on a missing
createSourceFile. That is not something it can patch around until the new API
stabilises, which is why its tracking issue targets TS 7.1.

So any tool doing import ts from "typescript" pins the repo to TypeScript 6.
Exactly one did — typescript-eslint (plus its own ts-api-utils) was the only
consumer of the compiler API in the whole tree. oxlint parses TypeScript itself,
so swapping the linter removed the last reason to carry two TypeScripts, and
typescript is a plain ^7.0.2 again.

The config was a faithful port, not a fresh start. .oxlintrc.json pins the
rule set — categories.correctness off, plugins just ["typescript"] — so
the 68 active rules are exactly what js.configs.recommended plus
tseslint.configs.recommended enforced, and a future oxlint release cannot
quietly widen what CI gates on. The one rule without an oxlint equivalent is
no-octal, which is unreachable here: octal literals are a syntax error in an
ES module, so tsc rejects them with TS1121 first.

Lint drops from 3.1s to 17ms and the dev tree loses 26 packages.

Security

aws-iam-authenticator 0.7.16 → 0.7.18, which exists to pull golang.org/x/net
and golang.org/x/sys past their CVEs. This binary ships inside the signed app
and runs as every user's kubeconfig exec plugin, so it is worth having. All
five checksums were recomputed from the release assets and match upstream's
authenticator_0.7.18_checksums.txt; the same method reproduces the 0.7.16 pins
being replaced.

Everything else

• AWS SDK clients → 3.1121.0, Electron → 44.0.0, uuid → 14.0.2, js-yaml → 5.4.1.
• GitHub Actions: checkout and setup-node → v7, and the Pages trio to
  configure-pages v6 / upload-pages-artifact v5 / deploy-pages v5.
  checkout v7 only blocks fork checkouts under pull_request_target and
  workflow_run, neither of which these workflows use; setup-node v7 drops a
  dummy NODE_AUTH_TOKEN export nothing here reads.
• Electron Forge stays on 8.0.0-alpha.10 — the newest 8.x. npm outdated
  flags it only because stable latest is 7.11.2, which would be a downgrade.

Verified

From a clean npm ci: build ok, lint ok, npm audit 0 vulnerabilities. The
TypeScript 7 emit was diffed against TypeScript 6's and is byte-identical for
both .js and .d.ts; only sourcemap mappings differ. oxlint was checked to
actually gate — an injected violation exits 1 with the expected rules, a clean
tree exits 0.

Not verified locally, and what this CI run is for: the full electron-forge make matrix, including macOS signing and notarization and the Windows
installer. Electron 44 is also days old, so its Chromium 152 behaviour in the
WebAuthn login window is worth a manual pass before cutting a release.

Deliberately left out

Type-aware lint rules are available (oxlint --type-aware with
oxlint-tsgolint, which runs on TS 7) but stay off here to keep this diff
reviewable. They currently report a dozen findings — mostly
no-floating-promises, plus two ${err} template expressions in
src/aws-sso.ts and src/aws-eks.ts that look like real bugs, since
describeError exists for exactly that and a non-Error throw stringifies to
[object Object] in a user-facing message. Worth its own PR.

Also left alone: NODEJS_VERSION stays at 22, and the glob@7/inflight
deprecation warnings persist because they come from copyfiles and
electron-winstaller, both already at their latest published versions and
carrying no advisories.

---

Labelling: this branch is claude/…, so autolabeler.yaml will not label
it from the branch name and version-resolver defaults to patch. Given the
macOS 13 floor, this likely wants minor set by hand, plus dependencies for
the changelog category.

🤖 Generated with Claude Code