build(deps-dev): harden dependency maintenance

[chhoumann]

Consolidate the current dependency queue into one validated maintenance change.

This applies only releases that have cleared the existing 7-day package quarantine, adds the same cooldown to Dependabot, and makes dependency installs reproducible across CI and releases. It also separates production and development update groups so only bundled production dependency updates trigger a plugin patch release.

Dependency changes:

• update jsdom to 29.1.1, Oxfmt to 0.57.0, and Oxlint to 1.72.0
• align Node type definitions with the Node 22 toolchain
• declare picomatch 4 as the optional peer required by svelte-check
• pin Wrangler 4.107.0 and use the local binary for docs deployment
• raise the Svelte minimum to the Vite plugin's actual peer minimum
• preserve the explicitly configured Commitizen workflow

Automation changes:

• add 7-day Dependabot cooldowns for npm, Actions, and pip version updates
• split npm production and development groups and add explicit ecosystem commit scopes
• add pip coverage for docs dependencies
• hold TypeScript majors while TypeScript 7 is incompatible with the current Svelte and lint toolchain
• use npm ci in test and release workflows
• run tests on pull requests and master pushes without duplicate branch runs
• run documentation builds on relevant pull requests with pip caching
• use .nvmrc from both Node workflows
• remove the unused NPM_TOKEN from the non-publishing release
• release a patch for future build(deps) production updates, but not build(deps-dev), ci(deps), or docs(deps)

This supersedes #244, #245, and #246:

• build(deps-dev): bump the npm-minor-patch group with 6 updates #244 includes releases that are still inside the 7-day cooldown, so only its eligible updates are included here
• build(deps-dev): bump typescript from 6.0.3 to 7.0.2 #245 fails dependency installation because TypeScript 7 is not yet supported by the current toolchain
• build(deps-dev): bump jsdom from 27.2.0 to 29.1.1 #246's jsdom update is included together with the required Node engine correction

Validation:

• npm ci under Node 22 with npm 11
• npm 10 clean-install dry run
• npm ls --all
• npm audit: 0 vulnerabilities
• npm run lint
• npm run format:check
• npm run typecheck
• npm run build
• npm run test: 69 files and 876 tests passed
• npm run docs:build
• semantic-release routing checks for deps, deps-dev, ci, and docs scopes
• real Obsidian isolated-vault load: PodNotes 2.17.2 loaded with no captured runtime errors

Refs #244
Refs #245
Refs #246

[github-actions]

🎉 This PR is included in version 2.17.3 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀