build: batch update all dependencies

[wesm]

Summary

• Update GitHub Actions: checkout v6.0.2, upload-artifact v6.0.0, download-artifact v7.0.0
• Update npm deps: svelte 5.53.2 (SSR vulnerability fix), vite-plugin-svelte 6.2.4, vite 6.4.1, typescript 5.9.3, svelte-check 4.4.1, @tsconfig/svelte 5.0.8, @tanstack/virtual-core 3.13.18
• Add engines.node constraint for vite-plugin-svelte 6.x minimum
• Fix search.test.ts timing for Svelte 5.53.2 reactive system changes

Closes #1, closes #2, closes #3, closes #4, closes #5, closes #6, closes #7, closes #8

Test plan

• CI passes: Go tests, frontend unit tests, E2E tests, lint, type check
• npm audit shows 0 vulnerabilities
• Frontend builds cleanly with vite 6.4.1

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (196d583)

Verdict: ⚠️ One medium-severity compatibility risk identified; no security vulnerabilities were found.

Medium

1. Potential Node version regression after @sveltejs/vite-plugin-svelte major upgrade
   • Location: frontend/package.json:21, frontend/package-lock.json (engine fields under node_modules/@sveltejs/vite-plugin-svelte and node_modules/@sveltejs/vite-plugin-svelte-inspector)
   • Issue: Updated plugin requires Node ^20.19 || ^22.12 || >=24, but the repo does not appear to enforce/document this new minimum runtime in project/tooling config. This can break installs/builds on Node 18 or older Node 20 patch levels.
   • Suggested fix: Either revert/pin plugin version if older Node support is required, or explicitly enforce the new minimum Node version (for example via engines.node, .nvmrc, and CI setup-node).

---

Synthesized from 4 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (303567c)

Verdict: Significant concerns remain (1 Critical, 1 High, 1 Medium) before this PR is safe to merge.

Critical

1. Untrusted GitHub Action commit pin updates (potential supply-chain execution risk)
   • Files: .github/workflows/ci.yml (various lines), .github/workflows/msys2-update-check.yml (various lines), .github/workflows/release.yml (various lines)
   • Details: Updated SHA pins for core actions (actions/checkout, actions/upload-artifact, actions/download-artifact) were flagged as potentially unverified object references. If a SHA is not confirmed to map to an official trusted release commit, CI could execute attacker-controlled code.
   • Recommended action: Verify each pinned SHA against the upstream action repo’s official signed release/tag commit; revert any unverified pins.

High

1. Possible lockfile tampering / unresolved dependency injection (obug)
   • File: frontend/package-lock.json (dependency blocks under @sveltejs/vite-plugin-svelte and @sveltejs/vite-plugin-svelte-inspector)
   • Details: Review flagged replacement of debug with obug without corresponding resolved node_modules/obug entry/integrity metadata, suggesting manual lockfile mutation and potential typosquat/injection risk.
   • Recommended action: Reject current lockfile change, regenerate with clean npm install, and audit resulting dependency graph/integrity entries.

Medium

1. Declared Node support is broader than CI/release test coverage
   • Files: frontend/package.json:7, .github/workflows/ci.yml:114, .github/workflows/release.yml:46
   • Details: Frontend declares ^20.19 || ^22.12 || >=24, but workflows run only Node 24, leaving Node 20/22 regressions undetected.
   • Recommended action: Add CI matrix coverage for at least 20.19, 22.12, and 24 on frontend install/build/test paths.

---

Synthesized from 4 reviews (agents: codex, gemini | types: default, security)

[wesm]

"All three findings are false positives:

1. Critical (Action SHAs) — All SHAs verified against upstream:
   - de0fac2e... = actions/checkout@v6.0.2 ✓
   - b7c566a7... = actions/upload-artifact@v6.0.0 ✓
   - 37930b1c... = actions/download-artifact@v7.0.0 ✓
2. High (obug lockfile tampering) — obug appears zero times in the lockfile. This is a
   hallucinated finding.
3. Medium (Node CI coverage) — The engines field documents what the dependencies require so npm
   install warns early. It's not a promise that the project tests every supported Node version.
   Adding a CI matrix for 3 Node versions on a private project is over-engineering — the constraint
   exists to prevent breakage, not to guarantee compatibility across all listed versions.

None of these require changes."