build(deps): pin typescript below 7 to unbreak the release build

[lmorchard]

Problem

pnpm run build is currently broken on main. That's the command release.yml runs between "Run tests" and "npm pack", so releases are blocked.

TypeError: Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')
  at rollup-plugin-dts@6.1.1_rollup@4.53.2_typescript@5.7.3/...

Cause

#617 (build(deps-dev): bump the devdependencies group) moved typescript from ^6.0.3 to ^7.0.2 across the root, packages/cli, and packages/core manifests.

tsup runs declaration emit through rollup-plugin-dts, which does not support TypeScript 7. There is no upgrade path today:

• tsup is already at its latest, 8.5.1
• rollup-plugin-dts@6.4.1 (latest) still declares peerDependencies.typescript: ^4.5 || ^5.0 || ^6.0

So this pins typescript back to ^6.0.3 until rollup-plugin-dts gains TS7 support.

Why this merged green

Nothing in CI ran the root pnpm run build. #614 adds the job that does, and it caught this on its first run against current main — the same gap that previously let the TS5101 baseUrl failure block a release while every PR stayed green.

#614 cannot go green until this lands.

Verification

On this branch:

Check	Result
pnpm install --frozen-lockfile	exit 0
pnpm run build	exit 0 — ESM ⚡️ Build success, DTS ⚡️ Build success
node dist/cli/src/cli.js --version	0.0.0, exit 0
pnpm run check	949 core / 229 cli / 103 server / 273 extension, all pass

Confirmed the inverse too: on clean main with no changes, pnpm run build exits 1 with the error above.

The ignoreDeprecations: "6.0" workaround already on main from #615 is what keeps TS6 itself working, so nothing else changes here.

Follow-up worth considering

Adding a dependabot.yml ignore for typescript major bumps would stop TS7 being re-proposed. Left out of this PR to keep it minimal — though once #614 is in, a re-proposed TS7 bump will at least fail loudly rather than land green.

🤖 Generated with Claude Code

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[lmorchard]

Force-pushed a correction. My first push only pinned the three manifests #617 touched (root, cli, core) — but pilo-extension and pilo-server also declare typescript, and they were already on ^7.0.2. That left the workspace inconsistent and Check shared dependency versions failed, correctly.

All five manifests are now aligned on ^6.0.3. Re-verified locally: check-dep-versions clean, --frozen-lockfile exit 0, pnpm run build exit 0 (ESM + DTS), built binary runs, full check suite green.