chore(deps): pin out TS7/ai-sdk-v4 majors, patch postcss + esbuild advisories (#87)

* chore(deps): ignore typescript and @ai-sdk/provider majors

Dependabot's dev-dependencies group keeps opening PRs that cannot pass
CI. TypeScript 7 breaks declaration emit: tsup bundles rollup-plugin-dts
6.x, whose peer range is "^4.5 || ^5.0 || ^6.0", and DTS build dies with
"Cannot read properties of undefined (reading
'useCaseSensitiveFileNames')". No released tsup or rollup-plugin-dts
supports TS7.

@ai-sdk/provider v4 is a spec migration, not a bump: the provider
implements LanguageModelV3* and declares peerDependencies ^3.0.0, so a
v4 dev dependency would typecheck against types consumers never install.

Both ignores are scoped to semver-major only; minor and patch updates
still flow through the group.

* chore(deps): patch postcss and esbuild advisories

Resolves the two open Dependabot alerts, both dev-only transitives:

- postcss 8.5.15 -> 8.5.25 (GHSA-r28c-9q8g-f849, high): sourceMappingURL
  path traversal. Reached via vite; a lockfile refresh is enough since
  vite wants ^8.5.15 and tsup peers ^8.4.12.
- esbuild 0.27.7 -> 0.28.1 (GHSA-g7r4-m6w7-qqqr, low): dev-server
  arbitrary file read on Windows. tsup pins ^0.27.0, so this needs an
  overrides entry to pull the patched minor.

npm audit reports 0 vulnerabilities. npm run prepublishOnly passes:
typecheck, 393 tests, ESM and DTS build.

Author: justin-carper

.github/dependabot.yml

@@ -11,6 +11,21 @@ updates:
           - "@opencode-ai/*"
       dev-dependencies:
         dependency-type: "development"
+    ignore:
+      # tsup's bundled rollup-plugin-dts (6.x, peer typescript
+      # "^4.5 || ^5.0 || ^6.0") crashes declaration emit under TypeScript 7:
+      # "Cannot read properties of undefined (reading
+      # 'useCaseSensitiveFileNames')". No released tsup or rollup-plugin-dts
+      # supports TS7 yet, so `npm run build` cannot pass with it. Drop this
+      # entry once rollup-plugin-dts declares TS7 support.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
+      # The provider implements the V3 language-model spec (LanguageModelV3*)
+      # and declares peerDependencies "@ai-sdk/provider": "^3.0.0". A v4 dev
+      # dependency typechecks against types consumers don't install, so the
+      # major has to be a deliberate spec migration, not a dependency bump.
+      - dependency-name: "@ai-sdk/provider"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "github-actions"
     directory: "/"