chore: consolidate remaining Dependabot updates

[systemicdream]

Consolidates the remaining Dependabot updates into one approval path.

Updates:

• pnpm/action-setup 4 to 6
• actions/setup-node 5 to 7
• actions/upload-artifact 4 to 7
• github/codeql-action 3 to 4
• @types/node 24.13.5 to 26.6.1
• prettier 3.9.7 to 3.9.8
• typescript 5.9.3 to 6.0.3
• @testing-library/jest-dom 6.9.1 to 7.0.1
• @vitejs/plugin-react 5.2.0 to 6.1.1

Local verification:

• frozen pnpm install
• format, lint, typecheck, test, and coverage
• infrastructure smoke test
• Gitleaks scan of the two-commit branch range
• git diff --check

The individual Dependabot PRs remain open until this PR has merged.