chore(deps): refresh eligible tooling

[GSTJ]

Summary

The development checks now use the dependency releases that cleared quarantine, with the repository's existing declaration style preserved.

Details

• Refreshes the lockfile for conventional-changelog 8.1.2, conventional-changelog-conventionalcommits 10.3.0, ESLint 10.8.1, @types/node 26.2.0, and @typescript-eslint/parser 8.67.0.
• Moves oxfmt to 0.63.0, oxlint to 1.78.0, and pnpm to 11.21.0.
• Keeps one-var off because oxlint 1.78 adds it to the shared style category and this repository keeps declarations separate.

Testing steps

1. From the repository root, run:

pnpm install --frozen-lockfile
pnpm audit --audit-level=low
pnpm run lint
pnpm run format
pnpm run typecheck
pnpm run test
pnpm run build
pnpm run changelog:check
npm pack --dry-run

2. Confirm every command exits successfully.

[github-actions]

🎉 Congratulations on making your first pull request in '@gstj/safe-jsx'! We appreciate your contribution and will review it as soon as possible. Thank you for helping us make this project better.

[GSTJ]

Proof from branch chore/refresh-eligible-dependencies at 143e67c: the frozen install, dependency audit, lint, format, typecheck, tests, release controls, build, changelog controls, and tarball dry run all pass.

The packed tarball also fixes the unsafe JSX sample through ESLint 10 flat config and ESLint 3 legacy config.