chore(deps): consolidate Dependabot updates

[lv10]

Consolidates the open Dependabot PRs into a single change.

Since this PR was opened, github-action-merge-dependabot auto-merged a batch of fresh
Dependabot PRs straight into master. master has been merged in and, wherever master
is now ahead, master wins — so four of the original targets are no longer part of this
diff. They are listed as superseded below.

Package / action	From	Dependabot asked for	Landed	Bump	Supersedes
eslint	8.51.0	9.39.1	9.39.5	major	#232
prettier	3.0.3	3.7.3	3.9.6	minor	#236
lint-staged	16.0.0	16.2.7	16.4.0	minor	#234
js-yaml (transitive)	4.1.0	4.1.1	4.3.1	minor	#233

Dropped as superseded by master

Package / action	This PR proposed	Already on master	Landed via
@commitlint/cli	^20.1.0	^21.2.2	#254
@commitlint/config-conventional	^20.0.0	^21.2.2	#253
actions/checkout	v6	v7	#247
actions/setup-node	v6	v7	#250

Merging this PR's .github/workflows/ci.yml hunk would have downgraded both actions from
v7 back to v6, so that hunk is dropped entirely — this PR no longer touches any workflow
file. The commitlint pair is likewise taken from master at ^21.2.2.

Pipeline fixes needed to land eslint 9

.eslintrc → eslint.config.mjs. eslint 9 no longer reads .eslintrc. Faithful port:
eslint:recommended + eslint-plugin-prettier's recommended config, ecmaVersion: 2021,
sourceType: 'module', node + es2021 globals, and the repo's existing
no-case-declarations: 'off'. .mjs because this package is "type": "module". @eslint/js
and globals are added as explicit dev dependencies, since flat config imports them directly.

Optional catch binding in parse-report.js. eslint 9 changed no-unused-vars to report
unused caught errors by default (caughtErrors: 'all'), flagging } catch (error) { in the
file: URL check where the binding is unused. Rewritten as } catch { rather than weakening
the rule.

Verification

• npm ci: ✅ lockfile resolves
• npm run lint: ✅ 0 problems
• npm test: ✅ both halves — the test/e2e/compare.js end-to-end comparison and tstyche
  type tests — matching the master baseline

The flat config was also checked against input that must trip it, rather than trusting a
green run: no-unused-vars on an unused catch binding, prettier/prettier, no-dupe-keys
and no-undef all report as expected, and no-case-declarations correctly stays silent.

The lockfile was reset to master's and re-derived with npm install; a version-by-version
comparison confirms no package resolves lower than it does on master.

Closes #239

[SociableSteve]

Checked the bumps against what this repo actually touches. eslint 8 to 9 is the only one with real breakage here, and both halves are handled: the flat config exists and does its job, and the catch (error) to catch {} change in parse-report.js is exactly what eslint 9's new no-unused-vars caughtErrors: 'all' default requires.

I confirmed the config is not a silent no-op by linting a probe file: no-unused-vars fired on an unused catch binding, prettier/prettier, no-undef and no-empty all fired, and no-case-declarations correctly stayed quiet. The flat config also covers all 11 files in the repo, so there is no lint coverage regression, and globals.es2021 is a real export rather than an undefined spread.

Manifest and lockfile agree exactly, including the legacy dependencies tree (187 entries, no drift or orphans), and I queried the registry for each resolved version rather than trusting the lock. No engines field and everything here is a devDependency, so consumers are unaffected. npm ci clean, lint 0 problems, tests pass both halves.

One small thing for whoever touches the config next, not blocking: the comment at the top says the .mjs extension is required because the package is "type": "module". That is inverted. "type": "module" is precisely the case where eslint.config.js is already ESM and needs no rename (I renamed it and eslint loaded it fine); .mjs is what a CommonJS package would need. Also ecmaVersion: 2021 is carried over faithfully from the old .eslintrc, but flat config defaults to latest, and this is the natural moment to drop the cap.

Approving.

[lv10]

This PR is merged (c809d4d). Recording the outcome here since the review landed against a branch that no longer exists.

The correction is right and I confirmed both halves against master. Tracked in #255:

1. The comment is inverted. eslint.config.mjs says "The .mjs extension is required: this package is "type": "module"". package.json does declare "type": "module" — which is exactly the case where no rename is needed, because eslint.config.js would already be parsed as ESM. .mjs is what a CommonJS package would require. Your rename test confirms it loads fine either way. The comment as written will mislead whoever copies this config to the next repo.
2. ecmaVersion: 2021 is now the only cap. Confirmed it is still in languageOptions. It was a faithful carry-over from the old .eslintrc, which was the right call for a migration PR, but flat config defaults to latest, so it now reads as a deliberate restriction with nothing behind it.

No other outstanding work — the eslint 8 -> 9 migration itself and the catch {} change in parse-report.js stand as reviewed.