Pin npm dependency versions

[amyu]

Summary

• Pin all npm dependencies and dev dependencies to the exact versions currently resolved in pnpm-lock.yaml.
• Configure Renovate's npm manager to keep dependency versions pinned.
• Update Biome to 2.5.5 and keep its package version, lockfile entry, and schema version aligned.
• Regenerate the bundled source maps after the pnpm peer-resolution paths changed.

Why

The existing caret ranges allowed Renovate to update Biome's schema and lockfile entry without changing package.json. Exact versions make the selected toolchain and runtime dependency versions visible in the manifest and ensure future Renovate pull requests update the manifest and lockfile together.

The lockfile update also changed pnpm virtual-store paths embedded in the Rollup source maps. The generated maps were not updated in #800, causing check-dist to fail. This pull request includes the regenerated maps and supersedes #800.

Impact

Future npm dependency updates will be explicit in package.json, and generated artifacts will match the pinned dependency graph.

Validation

• corepack pnpm install --frozen-lockfile
• corepack pnpm run all
  • TypeScript build
  • Biome lint
  • Rollup packaging
• git diff --check