chore(deps): safe-batch bump (8 deps)

[wxxb789]

Summary

Patch- and verified-minor/major-tier dependency bumps that the .claude/workflows/upgrade-deps.js plan cleared for the safe batch. All non-patch entries (zod, eslint, bumpp, lint-staged) were 3-vote adversarially reviewed against this repo's actual surface; the bumps below survived without source-code changes.

Independent of #28 and #29 — touches package.json + bun.lock only.

Changes

Runtime deps (4)

• @elysiajs/cors 1.4.1 → 1.4.2 (patch)
• citty 0.2.1 → 0.2.2 (patch)
• elysia 1.4.27 → 1.4.28 (patch)
• zod 4.3.6 → 4.4.3 (minor — verified no z.tuple/z.merge/z.preprocess/z.discriminatedUnion/z.toJSONSchema/z.base64/z.cuid/z.httpUrl usage; z.record() call sites use plain z.string() keys so the 4.4.0 record-key-transform change is inert)

Dev deps (4)

• @types/bun 1.3.10 → 1.3.14 (patch)
• eslint 10.0.3 → 10.4.1 (minor — engines floor unchanged; no meta.language/createRule in repo; flat config via @antfu/eslint-config 7.7.2 unaffected)
• bumpp 10.4.1 → 11.1.0 (major — only used in release:patch/release:minor/release:major scripts; CLI accepts the same patch --yes --commit --tag invocation; commit + tag templates unchanged)
• lint-staged 16.4.0 → 17.0.7 (major — wired into simple-git-hooks pre-commit; config surface {"*": "bun run lint --fix"} unaffected by listr2 v10 internals)

Verification

• bun run lint:all + typecheck + bun test (477 passing) + build + smoke:packaged — all green on fresh bun install --frozen-lockfile

Test Plan

• CI green locally on full pipeline
• zod nested-union path test still passes under 4.4.3
• lint-staged pre-commit fires correctly via bunx (manual repro)
• bumpp 11 produces identical chore: release vX.Y.Z commit + tag format

Notes

• knip 6.x was in this batch originally but the re-run with bundlerContext downgraded it to review-tier because of oxc-resolver / compilePathMappings rewrite + 6.10.0 default changes that shift the unused-export report against this repo's ~/* alias. Held back for a separate PR.
• The full upgrade-plan that classified these deps lives in #chore/add-upgrade-deps-workflow.