chore: streamline development tooling and harden maintenance scripts

.githooks/README.md

@@ -1,3 +1,3 @@
 # Git Hooks
 
-See [Git hook setup and checks](../docs/development.md#git-hooks).
+See [Git hooks](../docs/development.md#git-hooks) in the development guide for setup and checks.

.github/workflows/browser-matrix.yml

@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
       - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
         with:
           run_install: false
@@ -69,7 +69,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
       - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
         with:
           run_install: false
@@ -94,7 +94,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
       - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
         with:
           run_install: false

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
       - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
         with:
           run_install: false
@@ -39,15 +39,6 @@ jobs:
       - run: pnpm run typecheck
       - run: pnpm run typecheck:tsc
       - run: pnpm run test:coverage
-      - name: Install OSV Scanner
-        run: |
-          directory="$(mktemp -d "$RUNNER_TEMP/osv.XXXXXX")"
-          curl --fail --location --silent --show-error \
-            https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_amd64 \
-            --output "$directory/osv-scanner"
-          printf '%s  %s\n' ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108 "$directory/osv-scanner" | sha256sum --check --strict
-          chmod +x "$directory/osv-scanner"
-          printf '%s\n' "$directory" >> "$GITHUB_PATH"
       - run: pnpm run check:dependencies
       - run: pnpm run zip
       - name: Validate release branch version

.github/workflows/create-tag-on-merge.yml

@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version-file: .nvmrc
+          node-version-file: package.json
       - name: Validate and create the release tag
         env:
           RELEASE_BRANCH: ${{ github.event.pull_request.head.ref }}

.vscode/settings.json

@@ -1,7 +1,6 @@
 {
 	"editor.codeActionsOnSave": {
 		"source.organizeImports.biome": "explicit",
-
 		"source.fixAll.biome": "explicit"
 	},
 	"editor.formatOnSave": true,