chore(deps): batch dependabot updates (hold back incompatible majors)

[hoangsnowy]

Summary

Cherry-picks the open dependabot updates onto one branch so they land as a single reviewable batch with a coherent, regenerated lockfile. 13 of the 14 open dependabot PRs are integrated.

Integrated (13)

GitHub Actions: actions/checkout 5→6, actions/setup-node 5→6, softprops/action-gh-release 2→3, github/codeql-action 3→4.
npm (safe minor/patch): @types/react 19.2.15, postcss 8.5.15, @types/node 25.9.1, @typescript-eslint/{eslint-plugin,parser} 8.59.4, typescript-eslint 8.59.4, @tanstack/react-query 5.100.14, @tanstack/react-virtual 3.13.25, @cyclonedx/cdxgen 12.4.3, @vitest/coverage-v8 4.1.7, vitest 4.1.7.

Held back — incompatible majors

• electron 41→42 (chore(deps-dev): bump electron from 41.7.1 to 42.3.0 in the electron group across 1 directory #12): not cherry-picked. Hard rule in CLAUDE.md — Electron 42 ships node 22 cppgc/heap.h using a GCC builtin MSVC lacks, and better-sqlite3 has no Electron-42 prebuild. Native rebuild explodes on Windows.
• eslint 9→10 (from the eslint group, chore(deps-dev): bump the eslint group across 1 directory with 3 updates #27): reverted to ^9.36.0. eslint-plugin-react@7.37.5 peers eslint <=9.7; eslint 10 fails npm install (ERESOLVE). The group's @typescript-eslint 8.59.4 bump is kept.
• vite 7→8 + @vitejs/plugin-react 5→6 (from the vite group, chore(deps-dev): bump the vite group across 1 directory with 3 updates #29): reverted to ^7.0.0 / ^5.0.0. electron-vite@5 peers vite ^5||^6||^7; vite 8 fails npm install (ERESOLVE). The group's vitest 4.1.7 bump is kept.

Lockfile

Regenerated to a canonical fixed point under npm@11.6.2 install --package-lock-only (the exact command the lockfile guardrail runs), so the lockfile in sync check passes.

Test plan

• npm run lint -- --max-warnings 0 — clean
• npm run typecheck — clean (both tsconfigs)
• npm test — 95/95 passing
• npm run build — all three bundles built (vite 7.3.3)
• npm install --package-lock-only produces no drift (guardrail mirror)
• CI matrix (ubuntu + windows) green

Follow-ups (need maintainer decision)

• Close the 13 superseding dependabot PRs after merge (cherry-picks have different SHAs, so they won't auto-close).
• chore(deps-dev): bump electron from 41.7.1 to 42.3.0 in the electron group across 1 directory #12 (electron 42): leave open / close with a "blocked: MSVC + better-sqlite3" note.
• eslint 10 / vite 8 will stay blocked until eslint-plugin-react and electron-vite ship compatible peer ranges.