chore(deps): pin out TS7/ai-sdk-v4 majors, patch postcss + esbuild advisories

[justin-carper]

Closes the loop on the failing dependabot dev-dependencies PR (#83) and the two open Dependabot alerts.

Why #83 could not merge

Its package.json diff was two majors. Reproduced on the PR branch: typecheck and tests pass, ESM build passes, then declaration emit dies.

• typescript ^6.0.3 -> ^7.0.2 is the sole cause. tsup bundles rollup-plugin-dts 6.x for dts: true, whose peer range is typescript: ^4.5 || ^5.0 || ^6.0. Under TS7 the DTS step throws TypeError: Cannot read properties of undefined (reading 'useCaseSensitiveFileNames'). Installing only typescript@6.0.3 back into that same tree makes the build green, so the failure isolates to TypeScript alone. No released tsup (8.5.1) or rollup-plugin-dts (6.4.1) supports TS7.
• @ai-sdk/provider ^3.0.13 -> ^4.0.4 compiles today only by accident: v4 still ships the LanguageModelV3 types. The provider implements the V3 spec throughout and declares peerDependencies: { "@ai-sdk/provider": "^3.0.0" }, so a v4 dev dependency typechecks against types consumers never install. That major is a deliberate spec migration, not a dependency bump.

Changes

chore(deps): ignore typescript and @ai-sdk/provider majors

Adds an ignore block to the npm entry in .github/dependabot.yml, scoped to version-update:semver-major for both packages, each with a comment naming the concrete reason and the condition for removing it. Minor and patch updates keep flowing through the existing group.

chore(deps): patch postcss and esbuild advisories

Both alerts are dev-only transitives:

package	from	to	advisory
postcss	8.5.15	8.5.25	GHSA-r28c-9q8g-f849 (high) - sourceMappingURL path traversal
esbuild	0.27.7	0.28.1	GHSA-g7r4-m6w7-qqqr (low) - dev-server arbitrary file read on Windows

postcss needed only a lockfile refresh: vite wants ^8.5.15 and tsup peers ^8.4.12, both satisfied by 8.5.25. esbuild needed an overrides entry because tsup pins ^0.27.0. The both-overrides variant was tested first and produced an identical tree, so the narrower one shipped.

Lockfile churn is limited to esbuild plus its platform binaries, postcss, and nanoid 3.3.12 -> 3.3.16 (a postcss dependency). All resolved URLs remain registry.npmjs.org.

Verification

• npm run prepublishOnly exits 0: typecheck, 393 tests, ESM and DTS build success
• npm audit: 0 vulnerabilities, down from 1 high and 1 low
• No production source files changed